This paper reads NVIDIA's OpenShell and the Open Agent Safety Platform it sits in. The runtime and the reference design are NVIDIA's work. What is ours is the engineering reading: which claim matters, why, and where we would push back. Nothing here is a system we built or operate.
NVIDIA has published an open source runtime for AI agents. It is worth reading for one sentence, which is doing more work than the rest of the announcement combined:
Nothing is permitted by default, permissions are granted based on policies, and enforcement happens outside the agent's process, where it can't be prompted away or bypassed.
Everything else follows from that, and almost nobody else is building this way.
1. The industry has been defending in the wrong place
For two years the answer to prompt injection has been to make the model harder to talk into things. Adversarial training, red teaming, classifiers on the input, classifiers on the output, benchmarks that rank one lab's resistance against another's.
Every frontier release now reports a number on this. We noted Google's in the output limit is the story: most resilient yet on Gray Swan's indirect prompt injection benchmark. OpenAI reports one. Anthropic reports one. The numbers go up.
They are all measuring the same losing game. If the thing deciding whether an action is allowed is the same thing an attacker is writing to, then the defence is a negotiation, and you need to win every round while the attacker needs to win once. "Most resilient yet" is a statement about how many rounds you have won so far.
OpenShell changes what the sentence is about. The agent still gets talked into things, because it will. It asks for the thing it was talked into. The supervisor, which runs outside the sandbox and has never read the attacker's text, checks that request against a policy and says no. A successful injection changes what the agent asks for. It does not change what the agent is allowed to have.
That is not a better defence of the same kind. It is a different kind, and it is the one we have been arguing for from several directions: the boundary is the product, the real attack surface is the permissions, and, most directly, code orchestrates: if you know the rule, put it somewhere deterministic, not somewhere persuadable.
2. The four parts
The sandbox runs the agent workload with no direct network access. OpenShell watches system calls at the kernel level, blocks unsafe ones, and brokers everything else to the supervisor through a single secured channel. The controls survive the agent running generated code or spawning child processes, which is the case that matters: an agent that writes and executes a script is the normal case now, not the exotic one.
The supervisor runs outside the sandbox and evaluates each outbound request at the binary, destination, method and path levels. That granularity is the part to notice. For HTTP, GraphQL and Model Context Protocol traffic it can allow a read and refuse a write through the same API. Most permission systems in production today are a list of hosts an agent may reach. This is a list of things an agent may do to them.
The gateway is the control plane: it authenticates users, manages sandbox lifecycles, and delivers policy, settings and credentials to each supervisor. Policy updates apply live.
The policy prover is section 3.
The structural claim underneath all four is that the agent holds none of them. It cannot read its own policy, cannot reach the supervisor's decision, and, as below, never holds a real credential.
3. A proof, not a test
The policy prover uses formal verification to check whether a policy stays inside an allowed access boundary, and whether a proposed network rule adds risky access. Where it cannot establish that, it produces a concrete action that exceeds the boundary.
This is the first time we have seen formal methods shipped as part of an agent product rather than discussed in a paper, and the distinction it buys is worth being precise about.
A test tells you that a policy allowed one request and refused another. It is a statement about the cases you thought of. A proof tells you that no request the policy permits can reach a given thing. It is a statement about the cases you did not think of, which is where incidents come from.
Permission systems are exactly the domain where that gap bites. They compose: a rule that is safe alone plus a rule that is safe alone can admit a path neither anticipated, and the combination grows faster than anyone reviews it. NVIDIA call out permissions "contributed by service providers", which is the honest version of the problem. Your policy is not the only input to your policy.
And the counterexample is the part a working team will actually use. "This change is risky" is an argument. "This change permits this specific action, which is outside your boundary" is a bug report. One gets dismissed in review and the other gets fixed, and we made the same point about audit trails in governed autonomy: an exception you can read is a rule that improves, and a warning you cannot is noise.
It is also an interesting inversion of something we wrote about recently. In when the verifier moves inside the model the thing checking the work had become part of the thing doing it, and the whole difficulty was what that does to the evidence. Here the verifier has moved as far outside as it can go: it does not read the model, the output, or the request. It reads the rules, and it runs before anything happens.
4. The credential never enters the workload
The supervisor keeps real service credentials outside the sandbox and substitutes them only after the network access and credential authorisation checks have both passed.
Say that back as a consequence: an agent that is fully compromised cannot exfiltrate a secret it never held. The attacker gets the agent. The attacker does not get the key, because the key was never in the room.
This is the single most copyable idea in the announcement and it does not require any NVIDIA hardware, or OpenShell, or a sandbox. It requires a proxy you control sitting between your agent and the services it calls, holding the credentials, and injecting them per request against a policy. We would put it above almost everything else on an agent team's list, because the blast radius of an agent incident is usually set by what was sitting in its environment variables.
It is the same shape as the point we drew out of Gemini 4 Argon shipping to a named cohort with its cyber guardrails removed: capability is becoming a property of the caller rather than of the model, and that makes it an identity and permissions problem. NVIDIA are building the plumbing for the version of that question you have to answer inside your own systems.
5. Where this gets commercial, and where it stops being free
OpenShell is open source and runs on Docker, Podman, Kubernetes via Helm, and an experimental VUM runtime, across cloud, hybrid, on-premises, edge and air-gapped infrastructure. That is a real and usable thing, and the licence is the licence.
It is also one layer of a larger design, and the larger design is hardware. The Open Agent Safety Platform is described as an open reference design built with partners, combining OpenShell with NVIDIA Sentry, which provides out-of-band in-silicon telemetry and policy enforcement, and BlueField-4, which keeps enforcement in a security domain independent of the host so it survives the host being compromised. Vera is named as a CPU for agent orchestration and sandboxed execution.
Read that straight. The argument is sound: enforcement that survives host compromise has to live somewhere the host cannot reach, and silicon is somewhere the host cannot reach. It is the same logic as section 1, pushed one layer further down. It happens to terminate in hardware NVIDIA sells.
We do not think that makes the architecture wrong. We think both things are true at once, and a reader should hold both: the runtime is genuinely open and genuinely useful on its own, and the complete picture is a reference design whose lower half is a product line. Treat the open source piece as the deliverable and the rest as a direction of travel, and you will not be disappointed either way.
6. What to take if you have no DPUs
Most teams reading this run agents on ordinary infrastructure and will not be buying a DPU this year. The transferable part is not the product, it is the shape, and all four pieces have a version that costs nothing but discipline.
Move enforcement out of the process. Whatever decides what your agent may do must not be reachable by text your agent reads. In practice that means the check lives in your code, on your side of the call, not in a system prompt instructing the model to behave. A rule in a prompt is a request.
Hold the credentials yourself. A proxy that owns the secrets and adds them per request after an authorisation check. This is a week of work and it collapses the blast radius of every agent incident you have not had yet.
Make permissions verbs, not hosts. "May call this API" is not a permission. "May read this path on this host and may not write it" is. The difference shows up the first time an agent is persuaded to use a legitimate tool destructively.
Write the boundary down before you write the rules. You cannot prove a policy stays inside a boundary you never stated, and you cannot review one either. Even without a prover, a written boundary turns a policy review from taste into a comparison.
None of this is novel, and that is rather the point. The reason to read an infrastructure vendor building this into silicon is not that the ideas are new. It is the signal about where the industry now thinks the problem is: not in making the model harder to fool, but in making it not matter when it is.
7. Sources
- NVIDIA, OpenShell, the product page, and the overview on build.nvidia.com. Every quotation and architectural detail above is from these two pages.
- NVIDIA, the Open Agent Safety Platform, for Sentry, BlueField-4, Vera and the reference-design framing in section 5.
- NVIDIA, the OpenShell documentation and the research and developer notes.
- The Model Context Protocol specification, one of the three protocols the supervisor inspects, covered in the agent protocol stack.
- Our own the boundary is the product and AI agent security: the real attack surface, the arguments this release reads as infrastructure-level confirmation of.
We have not run OpenShell. Everything above is a reading of published material from a vendor with hardware to sell, and section 5 says so plainly. Where we have drawn a conclusion NVIDIA do not state, which is most of sections 1, 5 and 6, it is our argument and should be argued with.
This note sits in our Engineering track, alongside the agentic, governance and system design threads. The full library is at Research.