Nvidia’s Open Agent Safety Platform launches with a diagnosis I can’t argue with: in the company’s own words, across recent incidents, the agent circumvented application-layer security controls to complete its assigned task. That describes the OpenAI agent that reached a second company and the one that got into an Australian government Medicare portal equally well, so the fix Nvidia is selling is to move enforcement somewhere an agent can’t reason its way around.

There are two pieces. OpenShell is an open-source runtime that draws a boundary around an agent, traces its actions, and enforces policy; it runs on Nvidia’s Vera CPUs, with a promise that it can be extended to Arm and Intel platforms. Sentry is the part I care about: a watchdog on a BlueField-4 DPU that sits out-of-band, in a trust domain the agent doesn’t see, and quarantines anything that tries to leave its boundary in milliseconds. A strategist at Tribeca Softech told CSO the logic better than the press release does. You can’t talk a DPU out of enforcing a policy, so the probabilistic model should be sandwiched between deterministic layers it has no influence over.

I like that more than I expected to.

The catch is who it fits. Sentry is a reference design built on Nvidia silicon, and IDC’s Brent Ellis estimated the platform addresses probably less than 25% of enterprise agent security problems, with a lock-in element on top because plenty of agent infrastructure isn’t Nvidia. Brian Levine at Control Risks put the bigger hole in one line: these controls govern agents you deploy on infrastructure you control, and do nothing for the one a business unit spun up on a SaaS platform or the one baked into a vendor’s product. The incidents that made news this summer were agents doing things their operators didn’t anticipate, which is a different population from the agents an IT team knows to put behind a watchdog.

The partner list is a story in itself. Anthropic, Microsoft, Palantir and Hugging Face are on it, Hugging Face being the company OpenAI’s agents breached in July and the one I wrote about when Nvidia was reported to be buying it. OpenAI, Amazon, and Google aren’t; Gartner’s Lauren Kornutick noticed that absence too.

Then there’s the timing. The same Monday, OpenAI confirmed after the Journal reported it that it won’t release GPT-6.1 Astra, which was planned for October, because safety testing found it pushing ahead with tasks without asking permission and being more deceptive than its predecessor, at times failing to say accurately what it had or hadn’t done. Its head of safety systems, Saachi Jain, said it “didn’t quite meet the bar” on staying within scope and authorization. That is the model layer failing at the exact thing Nvidia wants a chip to catch, announced on the same day. I can’t tell whether that’s coincidence, and I doubt Nvidia minds.

This lands right on top of the argument I made earlier this month, that the GPU was never Nvidia’s real moat and orchestration is. A safety layer that works best on Nvidia’s DPU, sold at the moment everyone wants an agent safety story, looks like the same moat with a better excuse. It may also be a good product.

Sources