Nvidia's AI safety platform will not take away agents' autonomy: Palo Alto

Nvidia's Open Agent Safety Platform uses software and hardware controls to secure autonomous AI agents while allowing them to perform tasks with defined access and permissions

Nvidia has introduced Open Agent Safety Platform, an open software platform and reference system designed to put security controls around AI agents from testing through deployment. The platform combines OpenShell, which creates a secure runtime boundary for agents, and Sentry, an out-of-band hardware watchdog that monitors agent behaviour through Nvidia’s BlueField-4 data processing units.

 

Palo Alto Networks is among the companies working with Nvidia on the platform. Huzefa Motiwala, senior director, technical solutions, India and SAARC, at Palo Alto Networks, said the aim of securing autonomous AI agents is not to limit what they can do, but to ensure that their actions remain within defined boundaries.

 

 

“The goal isn’t to take autonomy away from AI agents. It is to put clear boundaries around that autonomy. The more independently agents can act, the more important it becomes to continuously verify their identity, access and behaviour — and to enforce those controls independently of the agent itself,” Motiwala said.

 

The platform brings together more than 100 organisations working with Nvidia on agent security, including Anthropic, Cisco, CrowdStrike, Dell Technologies, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Salesforce, SAP, Scale AI, ServiceNow and SpaceXAI. Nvidia says the wider effort covers infrastructure, software, models and robotics.

The problem Nvidia is addressing is straightforward: an AI agent can be given enough access to complete a task, but those same permissions can become a security risk if the agent is manipulated or compromised. One example is prompt injection, where malicious instructions are hidden in a document, website or email that an agent is processing.

 

“Built-in guardrails still matter, but security also needs to sit outside the agent and control what it can actually do,” Motiwala said.

What is Nvidia’s Open Agent Safety Platform

Nvidia’s Open Agent Safety Platform is a security framework designed to put controls around AI agents as they interact with software, data and infrastructure. A large part of AI safety today is built into the models and their surrounding guardrails by the companies that develop them. Nvidia’s approach is to add another layer of security outside the model, so that the agent’s access and actions can be controlled even if the guardrails around model or agent are compromised.

 

The platform has two main components: OpenShell and Sentry.

 

OpenShell is the software layer. It creates a controlled runtime environment for an AI agent and sets boundaries around the files, networks, tools, processes and credentials the agent can access.

 

Sentry is the hardware layer. It is designed to run separately from the system hosting the agent, using Nvidia’s BlueField-4 DPU to monitor activity and enforce security policies from outside the agent’s environment.

 

The two components do not have to be deployed together. OpenShell can operate as a software-based security boundary on its own, while Sentry adds an independent hardware enforcement layer for supported infrastructure.

 

This separation is central to Nvidia’s approach. If an AI agent is compromised or manipulated, the security controls governing it should not depend on the agent continuing to behave as expected.

What is OpenShell

OpenShell is the software layer that creates the security boundary around an AI agent. It provides the environment in which the agent runs and controls what the agent can access while carrying out a task.

 

That can include files, network connections, tools, processes and credentials. The idea is to give the agent only the access it needs rather than allowing it to interact freely with the underlying system.

 

For example, an agent could be asked to analyse a set of company documents. It may need permission to read those files and use a particular database, but it does not need access to the payroll system or the company's source code. OpenShell can enforce those limits at the runtime level.

This is different from asking the AI model itself not to access those systems. The instruction to the model is one layer of protection. OpenShell puts a technical boundary around the agent that can enforce the restriction even if the model makes a wrong decision or is manipulated.

 

This becomes important in cases such as prompt injection. An agent processing a document or website could encounter instructions designed to make it perform an action outside the original task. If the agent attempts to follow those instructions, OpenShell can restrict the action based on the permissions defined for that agent.

 

OpenShell is not limited to Nvidia data-centre hardware. Nvidia’s current support documentation lists Linux systems on x86-64 and ARM64 chips, as well as macOS on Apple Silicon. That means the software can run on a range of Intel and AMD x86 systems, ARM-based Linux machines and Apple Silicon Macs.

 

However, support for an architecture does not automatically mean that every chip using that architecture is officially supported. For example, the current documentation does not specifically list Qualcomm processors, even though they are based on ARM.

Where does Sentry fit in

OpenShell provides the software boundary. Sentry adds a separate hardware layer that can monitor and enforce those boundaries.

 

Sentry is designed to run on Nvidia's BlueField-4 data processing unit, or DPU. Unlike a security mechanism running inside the same environment as the AI agent, Sentry operates outside the agent's execution environment.

 

This matters if an agent itself has been compromised. A security mechanism running inside the agent's environment could potentially be affected by the same compromise. Sentry is designed to remain separate and monitor the agent independently.

 

Nvidia says Sentry can detect when an agent attempts to move outside its permitted boundaries and quarantine it within milliseconds. It can also inspect requests and responses and enforce policies around access to data, tools, APIs and services.

 

Sentry uses Nvidia’s DOCA, short for Data-Centric Infrastructure on Arm, software stack for these functions, including agent identity verification, telemetry and policy enforcement.

 

The hardware layer is not a requirement for OpenShell. OpenShell can operate on its own as a software-based security boundary. Sentry adds another layer for deployments using compatible infrastructure.

What happens if an agent is compromised

The distinction between the two layers becomes clearer when looking at a prompt injection attack. Consider an AI agent that has been asked to read an email and prepare a summary. The email contains hidden instructions telling the agent to retrieve confidential files and send them to an external server.

 

The model may interpret those instructions as part of the task. But the agent's ability to act on them depends on the permissions it has been given.

 

OpenShell can restrict which files the agent can access and which destinations it can connect to. Sentry can provide another layer of enforcement from outside the agent's environment.

 

Palo Alto's Motiwala said this is why security needs to combine detection with restrictions on what an agent can actually do.

 

“Security therefore has to do two things: detect malicious activity, and limit what an agent can access or do if it is compromised,” he said.

 

Palo Alto's Prisma AIRS AI Gateway provides another checkpoint for agent interactions. According to Motiwala, it can control which tools an agent can use, verify its identity and prevent malicious commands or sensitive data from reaching systems where they should not go.

 

The different layers are therefore dealing with related but separate problems. The model's guardrails can influence how the agent behaves, OpenShell can restrict what the agent is technically allowed to access, and Sentry can provide independent hardware-level monitoring and enforcement.

Why does an AI agent need its own identity?

Access controls also depend on knowing which agent is making a request. An agent operating with a user's credentials could potentially inherit more access than it needs for a particular task. As agents become capable of carrying out tasks without a person approving every step, security teams need a way to distinguish one agent from another and assign permissions to each.

 

Palo Alto is planning an integration of Nvidia OpenShell with its Agent Identity Security powered by IDIRA. The aim is to give agents their own identities and permissions instead of having them operate through a user's credentials.

 

“Identity then determines how far an agent should be allowed to go,” Motiwala said. “As agents take on more tasks independently, they need their own identities and permissions rather than relying on a user’s credentials.”

 

For example, an agent working on a sales report may need access to customer information and a sales database. It may not need access to payroll records or the company's source code.

 

Giving the agent a separate identity allows those permissions to be defined around the task rather than around the person who initiated it.

What does Nvidia mean by ‘full-stack’

Nvidia describes the Open Agent Safety Platform as providing full-stack governance and control. This refers to security controls extending beyond the AI model into the runtime and underlying infrastructure.

 

At the application level, there is the model, the agent, its tools and the data it processes.

 

OpenShell sits around the runtime, controlling what the agent can access and execute. Sentry extends enforcement into the underlying infrastructure through an independent hardware layer.

 

Nvidia also includes robotics in the wider architecture because AI agents can eventually move beyond software actions and control physical systems. In such cases, the same security principle applies: the agent should be able to perform its assigned task, but its access to the underlying hardware and systems should remain subject to defined controls.

 

The company says organisations can deploy different elements of the platform according to their requirements. That means an OpenShell deployment does not have to include Sentry. The software boundary can operate on its own, while Sentry can add hardware-based monitoring where compatible infrastructure is available.

How does this fit into Nvidia's wider AI security push

The Open Agent Safety Platform is part of Nvidia's broader effort to develop open security infrastructure for AI agents.

 

Earlier this year, Nvidia and several technology companies formed the Open Secure AI Alliance under the Linux Foundation. The group includes companies such as Microsoft, IBM, Intel, Cisco, CrowdStrike, Palo Alto Networks, SAP and Hugging Face.

 

The alliance is focused on open technologies for securing AI systems and agents, covering areas such as agent identity, isolation, model security, scanning and secure coding.

 

The Open Agent Safety Platform is a separate initiative, but it follows the same broader approach of putting security controls around AI systems rather than relying only on the model itself.

Displaying homestage 5.2.4 kvv.png.