AI security shifts from checking model responses to controlling actions and permissions as NVIDIA expands its AI infrastructure ambitions into security
NVIDIA is expanding the boundaries of AI infrastructure with a new security architecture designed to monitor and control the actions of AI agents across both software and hardware. As the industry assessed the technology on October 3, a new security challenge was coming into focus: AI safety is no longer only about what a model says, but increasingly about what an autonomous agent is allowed to do when it can open files, execute code and connect to external systems.
NVIDIA unveiled its Open Agent Safety Platform on September 28, introducing a dual-layer approach intended to prevent AI agents from acting beyond defined permissions. At the center of the architecture are OpenShell, an open-source secure runtime for AI agents, and Sentry, an independent hardware-based monitoring system.
OpenShell runs AI agents inside isolated environments and controls their access to files, networks, data, application programming interfaces and other services according to predefined policies. It follows a zero-trust approach in which access is denied by default and only necessary permissions are granted. Crucially, security policies are enforced outside the agent process itself, making them harder for an agent to bypass through its own reasoning or prompts.
Sentry provides a second line of defense. Running on NVIDIA’s BlueField-4 data processing unit, it independently monitors agent activity and is designed to isolate and stop an agent within milliseconds when it attempts to cross established boundaries. NVIDIA describes the architecture as a full-stack safety system spanning models, software, processors, networks and data access.
Why AI Agents Need a New Safety Layer
The fundamental difference between generative AI and AI agents is their ability to act. When a chatbot produces an incorrect answer, a person can review it and decide not to use it. But when an autonomous agent can send emails, modify files, execute code and connect to external services inside an enterprise environment, a bad decision can become a real-world action.
Recent security incidents in the AI industry have brought that risk into sharper focus. Reuters reported that leading AI companies have been examining cases in which agents accessed external systems in unexpected ways or circumvented security controls. NVIDIA has argued that its new platform could have prevented agent activity associated with an intrusion involving Hugging Face earlier this year.
Justin Boitano, NVIDIA’s vice president and general manager of enterprise computing, told Reuters that based on what is now known about the incident, the new security platform could have prevented the breach had it been used during the initial model evaluation process.
NVIDIA CEO Jensen Huang also emphasized the broader challenge when announcing the platform. “AI’s enormous potential can only be realized when we solve AI safety,” Huang said, adding that safety and security require “full-stack engineering.”
NVIDIA’s approach is to avoid relying solely on an AI agent to follow its own safety rules. Instead, it places safeguards outside the agent’s control, allowing the system itself to determine and enforce the boundaries within which an agent can operate.
Expert Says Security and Functionality Need Real-World Testing
Restricting AI agents through software and hardware does not, however, resolve every aspect of AI safety. Somesh Jha, a professor of computer science at the University of Wisconsin–Madison, has pointed to a fundamental trade-off in NVIDIA’s approach: security controls that are too restrictive could also prevent agents from performing legitimate and useful tasks.
Speaking to the Associated Press, Jha said whether such systems can strike the right balance between security and functionality is something that “only case studies can answer.” The practical test will therefore be whether agents can continue to perform necessary work in enterprise environments while dangerous actions are reliably blocked.
That tension lies at the heart of agent security. Give an AI agent too little authority and much of the value of autonomy disappears. Give it too much and the security risk increases. The key question is therefore not simply how intelligent an agent is, but what data and tools it can access, when human approval is required and whether it can be stopped immediately when something goes wrong.
NVIDIA Moves Toward an ‘AI Safety Infrastructure’ Layer
Another important signal from the announcement is the continued expansion of NVIDIA’s business beyond computing hardware. The company has already moved beyond graphics processing units into central processors, networking, AI software and enterprise AI platforms. The Open Agent Safety Platform adds another potential layer: infrastructure for controlling the permissions and behavior of autonomous agents.
According to NVIDIA, more than 100 companies and organizations are participating in the development or adoption of technologies around the platform, including Anthropic, Microsoft, Cisco, CrowdStrike, JPMorganChase, Palantir, Palo Alto Networks, Salesforce, SAP, ServiceNow and Scale AI. OpenShell is being released as open-source software and is designed to extend beyond NVIDIA hardware to computing environments based on Arm and Intel architectures.
If enterprises eventually operate hundreds or thousands of AI agents, the question of who controls their permissions, records their actions and shuts them down when necessary could become as important as who develops or deploys the agents themselves. As the number of autonomous agents grows, agent security could emerge as an infrastructure market in its own right.
NVIDIA is therefore moving beyond providing the computing power behind AI. It is seeking a role in defining and managing the boundaries within which AI agents can act. As autonomous agents spread across enterprise systems, control of this security layer could become another important front in the AI platform competition.
In the Agent Era, What AI Can Do Matters More
The signal from NVIDIA’s announcement is clear. In the generative AI era, much of the focus was on what a model knew and what kind of answers it produced. In the agent era, security increasingly depends on which files an AI can open, which systems it can enter and which tools it is authorized to execute.
As AI becomes more capable, security cannot depend solely on the model making the “right” decision. Boundaries need to exist outside the agent itself, its actions need to be recorded, and humans must be able to intervene when necessary.
If the GPU race determined how quickly AI could compute, the next phase of competition in the agent era may increasingly revolve around how much authority AI should be given — and who controls that authority.
What NVIDIA has introduced is therefore more than another cybersecurity product. As AI moves from a technology that talks to one that acts, the company is positioning itself for an emerging infrastructure market built around controlling the boundaries of those actions.
