The Pulse
NVIDIA Extends OpenShell Agent Security to BlueField Chips
NVIDIA announced an OpenShell reference architecture that combines agent runtime controls with monitoring and enforcement on BlueField-4 processors. The design is available now, while partner integrations and ServiceNow’s AI Passport enforc
AI.info Team · Written with AI · fact-checked ·
NVIDIA says AI agents need security controls that reach beyond software, down to the processors running them. Its new OpenShell reference architecture puts policy enforcement at that hardware level; partner announcements show pieces of the system moving toward deployment, but some integrations remain planned rather than available.
Announced Oct. 21 at GTC Berlin, the architecture combines OpenShell runtime software with NVIDIA Vera CPUs, Vera Rubin infrastructure and BlueField-4 data processing units. NVIDIA says the system is available now. It is designed to let companies set limits on agent activity in software, monitor behavior outside the agent’s runtime and stop activity that crosses those limits.
OpenShell moves enforcement beyond the runtime
OpenShell supplies the runtime boundary, while NVIDIA Sentry runs on BlueField-4 and monitors agent behavior separately from the agent’s software environment. NVIDIA says Sentry can quarantine and stop an agent that tries to leave its permitted boundary “in milliseconds.” The company says the architecture also reaches edge systems including RTX Spark, DGX Spark and DGX Station.
“AI capability and safety must advance together,” NVIDIA founder and CEO Jensen Huang said in the announcement. He described the design as a way to give agents room to work within defined limits: “contained, monitored and under control.” The architecture, in NVIDIA’s framing, binds agent execution to infrastructure policy rather than relying only on safeguards inside an application.
The company says OpenShell can run across Linux and Kubernetes environments, including systems powered by Canonical, SUSE and Red Hat, as well as Microsoft Windows using Microsoft Execution Containers. It also names cloud platforms from Amazon Web Services, Google Cloud and Microsoft Azure. NVIDIA lists model providers including Anthropic, Google, Meta, OpenAI and Perplexity as compatible with the infrastructure.
Partner plans vary from integration to availability
The partner announcements illustrate the difference between a published architecture and products already in customer hands. CrowdStrike says it is integrating its Falcon Guardian AI detection and response service with OpenShell, while its planned Sentry integration would add hardware-level monitoring and enforcement. The company’s announcement describes those Sentry capabilities as planned, not as a completed deployment.
ServiceNow offers a more concrete software example: its Arc personal agent is generally available, governed by the company’s Super Intelligence Control Tower and enforced with OpenShell. But the related AI Passport feature—which is intended to carry permission records into OpenShell and BlueField enforcement—is expected in a future release. ServiceNow says revocations could propagate across software and hardware in about one second once that capability is available.
Claims depend on controls outside the agent
NVIDIA’s design shifts part of the security burden to infrastructure that the agent itself does not control. That is the central distinction in its pitch: OpenShell constrains execution in software, while Sentry is meant to monitor and enforce policy from the BlueField processor. NVIDIA says Sentry can quarantine an agent that crosses its boundary, but the announcement does not provide independent test results or describe performance across specific deployment conditions.
For now, the architecture is available, and NVIDIA has named a broad set of infrastructure, software and security partners working with it. The announcements also show that particular integrations have separate schedules: CrowdStrike describes hardware enforcement as planned, while ServiceNow says AI Passport enforcement is still forthcoming. The practical test will be whether those controls work together in deployed systems, not simply whether the reference design can be installed.