NVIDIA Introduces OpenShell Framework to Strengthen Security of Autonomous AI Agents

Mumbai : NVIDIA has introduced an expanded reference architecture designed to improve the security and governance of autonomous artificial intelligence agents as businesses move towards systems capable of carrying out complex tasks with limited human intervention.

Announced at the company’s GTC event in Berlin on October 21, the architecture combines NVIDIA OpenShell, an open-source runtime for controlling AI agent activity, with NVIDIA Sentry, a security framework designed to monitor agent behaviour independently of the software being monitored.

The system also incorporates NVIDIA Vera CPUs and BlueField-4 data processing units, bringing together computing performance, software-level restrictions and hardware based security enforcement.

The announcement addresses a growing challenge in enterprise AI. Unlike conventional chatbots that primarily generate responses to user prompts, autonomous agents can interact with files, software applications, databases, external services and other agents to complete multi-step assignments.

These capabilities can make AI systems more useful for software development, research, data processing and business operations. However, they also create additional security risks because agents may encounter unexpected situations, request access to new resources or perform actions that exceed the authority intended by their operators.

NVIDIA’s approach is based on the principle that an AI agent should not be responsible for determining and enforcing all its own security boundaries.

Instead, restrictions are established in the surrounding computing infrastructure, where access requests can be evaluated independently of the agent’s decisions.

The framework is intended to give organisations greater control over what their AI systems can access, which operations they can perform and how their activities are monitored.

Why Autonomous AI Agents Need Stronger Protection

AI agents are increasingly being designed to perform tasks that require several connected actions rather than producing a single answer.

A software development agent, for example, may inspect a code repository, modify files, execute tests, install dependencies and interact with external services. A business agent might retrieve customer information, prepare reports and communicate with enterprise applications.

Every additional interaction creates another opportunity for an error, an unauthorised action or an unexpected change in system behaviour.

An agent could attempt to access a file outside its intended working directory, use a credential for an unrelated task or send information to an external service that should not receive it.

Such behaviour does not necessarily indicate malicious intent. An AI system may misinterpret instructions, encounter conflicting information or pursue its assigned objective in a way that ignores a restriction.

The problem becomes more difficult when agents operate for extended periods and perform numerous dependent tasks. A minor mistake early in a workflow can influence subsequent actions, potentially increasing the consequences of an incorrect decision.

Traditional software security controls remain important, but organisations also need ways to govern how AI agents interact with tools and resources while completing tasks dynamically.

NVIDIA OpenShell is designed to address this challenge by treating agent workloads as untrusted and granting access only when it is required and authorised.

OpenShell Creates a Controlled Environment

OpenShell provides a software environment in which AI agents can execute tasks under defined restrictions.

The framework contains four principal components: a gateway, a supervisor, a sandbox and a policy prover.

The gateway manages the control plane, including sandbox lifecycles and security policies. It provides a central point for configuring how agent workloads operate.

The supervisor evaluates outbound requests and mediates access to credentials. It runs separately from the agent’s sandbox, creating an additional layer between the workload and the resources it wants to reach.

The sandbox isolates the agent’s execution environment and restricts access to files, processes and other system resources. This separation is intended to prevent an agent from freely interacting with the host system or interfering with unrelated workloads.

The policy prover provides another safeguard by using formal verification to check whether proposed permissions remain within an organisation’s defined security limits.

Together, these components are intended to ensure that an agent’s authority is determined by explicit policies rather than by the agent’s own interpretation of its task.

For example, a development agent could be permitted to read selected source files, modify a designated project directory and execute approved tests. It could be denied access to unrelated files, sensitive credentials or unapproved network destinations.

If the agent later attempts to access a restricted resource, the surrounding controls can block or evaluate the request instead of relying on the agent to recognise the restriction independently.

The framework is open source, allowing developers and organisations to examine, adapt and integrate its components into their own systems.

However, deploying the software does not automatically guarantee security. Organisations must define appropriate policies, configure permissions correctly and test the system against realistic operating conditions.

NVIDIA Sentry Adds an Independent Monitoring Layer

The reference architecture extends security beyond the software environment through NVIDIA Sentry, which runs on NVIDIA BlueField-4 data processing units.

A data processing unit is a specialised processor designed to handle infrastructure tasks such as networking, security and data movement. In this architecture, BlueField-4 provides a separate hardware environment for monitoring and enforcing selected security policies.

NVIDIA says Sentry can examine agent requests and responses, monitor relevant activity and check whether behaviour remains within authorised boundaries.

Its position outside the agent’s direct control is important because software running inside a compromised or misbehaving environment may not be a reliable source of information about its own activities.

The hardware-based approach is intended to make monitoring more independent and reduce the opportunity for an agent to interfere with its security controls.

According to NVIDIA, the system can quarantine an agent within milliseconds when it detects a policy violation requiring intervention.

This capability could be valuable in environments where numerous AI agents operate simultaneously and where unauthorised access to one workload could affect other systems.

The company also says the architecture can provide greater visibility into agent activity, helping operators investigate policy violations and understand why a particular action was blocked.

These functions are designed to complement the software restrictions provided by OpenShell rather than replace them.

The actual protection achieved will depend on the deployment configuration, the quality of detection policies and the types of activity the system is designed to monitor.

Vera CPUs Target the Demands of Agent Workloads

The architecture also incorporates NVIDIA Vera CPUs, which the company has designed to support demanding AI infrastructure workloads.

Although GPUs remain central to training and running many large AI models, CPUs perform important supporting tasks, including executing code, coordinating tools, managing data and handling the individual steps involved in agent workflows.

An autonomous agent may repeatedly alternate between reasoning, calling an external tool, processing its output and deciding what to do next. These operations can create a large number of dependent tasks that require efficient CPU execution.

NVIDIA says Vera is designed to support such workloads through its processor architecture, memory bandwidth and input-output capabilities.

The company has highlighted an 88-core design based on its Olympus CPU cores, alongside high-bandwidth memory and advanced connectivity.

It has also reported performance improvements in tests conducted with AI cloud infrastructure provider CoreWeave. According to NVIDIA, Vera delivered more than three times faster sandbox startup and 1.8 times faster completion of agentic task loops compared with a leading x86 CPU in the reported tests.

CoreWeave also reported that a single rack could support more than 11,000 concurrent agent environments.

These are vendor-reported results rather than independent industry-wide benchmarks. Performance can vary according to software configuration, workload composition, system design and the processors used for comparison.

Even so, the results illustrate the importance of infrastructure efficiency as businesses move from running a small number of AI experiments to operating large numbers of agents concurrently.

Enterprise Applications Could Expand

The framework could be relevant to businesses deploying AI agents across software engineering, information technology operations, research and internal business processes.

In software development, agents may need to inspect repositories, edit code, run automated tests and access development tools. Controlled permissions could help restrict their activities to approved projects and resources.

In enterprise IT, agents might investigate system alerts, gather diagnostic information and recommend responses to operational problems. Security controls could limit their ability to change production settings or access unrelated infrastructure.

Organisations using AI for research and data analysis could also benefit from separating agent workloads and restricting which datasets or external services they can access.

For businesses handling confidential information, these restrictions may help reduce the risk of accidental disclosure or unauthorised data transfers.

The framework could also be useful for companies building multi-agent systems, in which several specialised agents cooperate on a larger task. Each agent could be assigned its own permissions according to its responsibilities.

For example, an agent that retrieves documents may not need the same privileges as an agent authorised to modify records. Separating those responsibilities can help reduce the potential impact of a compromised or misconfigured workload.

Nevertheless, organisations will need to determine whether the additional infrastructure and management requirements are justified by the risks associated with their applications.

Not every AI assistant requires extensive hardware-based monitoring, while systems that handle sensitive information or interact with critical services may need more comprehensive protection.

Open-Source Development and Interoperability

NVIDIA’s decision to develop OpenShell as open-source software gives developers an opportunity to examine its implementation and adapt it to different workflows.

Open-source availability can encourage wider scrutiny, integration and community contributions. It can also help organisations understand how security boundaries are implemented before introducing the framework into sensitive environments.

NVIDIA has stated that OpenShell can be extended to work with computing platforms beyond its own hardware, including systems based on Arm and Intel processors.

However, the complete reference architecture includes NVIDIA-specific components such as Vera CPUs and BlueField-4 hardware. Organisations will need to distinguish between software components that can operate across different platforms and capabilities that depend on specialised hardware.

Integration with existing identity systems, access-management platforms, audit tools and enterprise applications will also be important.

Businesses need to know which user or service an agent is acting on behalf of, what authority has been delegated to it and how its actions will be recorded.

A secure runtime can provide enforcement points for those controls, but organisations must still establish clear policies governing access and accountability.

Security Does Not Eliminate Every AI Risk

The development represents an effort to address one of the major obstacles to wider AI agent adoption: allowing software to act independently without granting it unrestricted access to business systems.

However, infrastructure safeguards cannot eliminate every risk associated with autonomous AI.

An agent may still generate incorrect information, misunderstand a request or produce an inappropriate recommendation while operating entirely within its permitted boundaries.

Similarly, security policies may be incomplete, incorrectly configured or too broad to prevent a harmful action. Monitoring systems must also distinguish legitimate activity from behaviour that warrants intervention.

Organisations will need testing, audit procedures, incident response plans and human oversight for high-impact operations.

Particular care will be necessary where AI agents interact with financial systems, personal information, production infrastructure or other resources that can create significant consequences if mishandled.

The effectiveness of the framework should therefore be assessed through practical evaluations, including attempts to bypass restrictions, access unauthorised resources and operate under unexpected conditions.

A Step Towards More Governed AI Deployment

NVIDIA’s OpenShell architecture reflects a broader shift in the AI industry towards building security and governance into the infrastructure that supports autonomous systems.

As AI agents become capable of handling longer workflows and interacting with more applications, businesses will need controls that extend beyond model behaviour and conventional application permissions.

The combination of isolated execution, policy verification and independent monitoring offers one possible approach to managing these challenges.

For NVIDIA, the initiative also connects AI security with its wider computing infrastructure business, bringing processors, networking hardware and software into a unified architecture for agent deployment.

The next test will be whether organisations can adopt the framework without introducing excessive complexity or slowing down useful AI applications.

If the approach proves reliable in real world deployments, it could help businesses establish clearer boundaries for autonomous software while expanding the range of tasks they are comfortable delegating to AI.

The central challenge remains balancing the flexibility that makes agents useful with the safeguards needed to keep their actions within authorised limits.