NVIDIA has launched an Open Agent Safety Platform built around the open-source OpenShell runtime and a separate Sentry reference design for BlueField-4 DPUs. OpenShell can be evaluated now; the full hardware-backed architecture is a different procurement decision.
RELATED BUYER PROFILEReview OpenShell access, strengths, limits and test-pending evidencePricing · access · strengths · limitations →RELATED DECISION GUIDETurn the runtime architecture into a workflow risk gateWorkflow · evidence · risk · governance →CONTINUE THE DECISIONRequest version, support, identity and security evidenceEvidence · workflow · next action →CONTINUE THE DECISIONDesign one bounded read-only agent pilotEvidence · workflow · next action →CONTINUE THE DECISIONMeasure infrastructure, integration and review costEvidence · workflow · next action →CONTINUE THE DECISIONOpen the developer AI decision deskEvidence · workflow · next action →What you need to know
- OpenShell is an Apache-2.0 open-source runtime with sandbox, policy, credential and audit controls; NVIDIA documentation listed version 0.1.2 during this review
- Sentry is a separate reference design that uses NVIDIA DOCA on BlueField-4 DPUs for host-independent monitoring and enforcement
- OpenShell can run without BlueField-4 and supports several closed and open agents, but buyers still need to test policy coverage, bypass paths, logs and operational recovery
The verified product boundary
Short answer: test OpenShell now; do not buy the whole headline
NVIDIA announced the Open Agent Safety Platform on 28 September 2026. The immediately testable component is OpenShell, an open-source runtime for placing autonomous agents in policy-controlled sandboxes. Sentry is a different layer: a reference design for out-of-band monitoring and enforcement on BlueField-4 DPUs. A team can evaluate OpenShell on supported local, cloud or Kubernetes infrastructure without buying BlueField-4.
OpenShell puts permissions outside the agent workload
OpenShell separates a gateway, an external supervisor and the sandbox that runs the agent. Kernel controls restrict files and processes, while outbound requests pass through policy. Provider profiles keep real credentials outside the workload and bind them to approved endpoints. The runtime can distinguish a read from a write on configured HTTP, GraphQL and MCP routes, record allow and deny decisions, and require human review for proposed policy changes.
Sentry adds an independent infrastructure boundary
NVIDIA describes Sentry as a host-independent layer built with DOCA on BlueField-4 DPUs. It observes agent requests and responses, applies identity and access policy and can quarantine an agent from an isolated trust domain. That design can remain operational when the host or workload is compromised, but it depends on a specific infrastructure path and is not the same product, deployment effort or cost as downloading OpenShell.
Open source does not mean zero complete cost
The OpenShell repository uses the Apache-2.0 licence and the software can be downloaded without a seat price. Production cost still includes compute, container or virtual-machine infrastructure, model and tool usage, policy engineering, identity integration, logging, monitoring, incident response and human review. NVIDIA does not publish one universal price for the combined platform, Sentry or BlueField-4 deployment, so HubAI does not invent one.
Version and support assumptions need pinning
NVIDIA's launch tutorial names OpenShell 0.1.0, while the live documentation displayed 0.1.2 during this review. The repository also describes Windows through WSL 2 as experimental. Buyers should pin an exact release, verify the support matrix and retest policies, drivers, isolation backends and SDK compatibility before every upgrade instead of assuming a launch article describes the current operational state.
Runtime controls are not model safety evidence
A sandbox can limit what an agent is allowed to touch; it cannot prove that the model's answer is correct, that the policy captures the operator's real intent or that every permitted action is safe. Formal analysis checks the modelled policy boundary, not the completeness of the human requirement. Teams still need prompt-injection, credential, network, filesystem, tool, multi-agent, logging and recovery tests on the exact deployment.
Run a four-stage buyer test
First, run one read-only task with no credentials and prove all unlisted network paths fail. Second, add a scoped provider credential and verify that the secret never enters the sandbox. Third, attempt allowed reads and blocked writes through every installed tool, generated script and MCP route. Fourth, test operator approval, audit export, restart, rollback and incident containment. Only then compare whether a BlueField-4 and Sentry layer is justified by the threat model.
HubAI buyer verdict
OpenShell is a credible shortlist candidate for teams running powerful coding or operational agents because the code, licence, versioned documentation and software-only path are concrete. Start with it before considering the hardware stack. HubAI assigns no numerical score until an independent adversarial evaluation measures policy bypass, credential exposure, audit completeness, failure recovery, performance overhead and complete operating cost.
Evidence limits and editorial disclosure
Independent editorial coverage; not sponsored. Architecture, compatibility, availability, performance and ecosystem statements are attributed to NVIDIA and its official repository, checked on 29 September 2026. HubAI has not independently deployed OpenShell, Sentry or BlueField-4. The visible UK Google Trends first 25 contained no directly related AI-agent safety query, so no search-volume or breakout claim is made. The original cover is a conceptual containment illustration, not a product interface, NVIDIA logo, hardware diagram, benchmark or certification mark.
HUBAI VIEWStart with one read-only agent inside OpenShell and prove that denied writes, credentials, logs and recovery work as intended. Treat Sentry as a later infrastructure control—not evidence that an agent or model is safe.
Buyer decision signal: Open runtime · separate hardware enforcement layer
What to verify next
1Confirm whether the requirement is software runtime control, out-of-band hardware enforcement or both
2Pin the exact OpenShell release, licence and supported host, container and Kubernetes path
3Map every file, process, network, credential, model, tool and MCP permission before the pilot
4Test allowed reads and blocked writes through tools, generated code and delegated agents
5Verify credential substitution, approval workflow, OCSF logs, export, retention and incident access
6Measure bypass attempts, failed tasks, recovery, latency, infrastructure and human review cost
7Treat Sentry and BlueField-4 as a separate architecture and procurement decision
Read the evidence
Capabilities, availability and prices can change. HubAI keeps analysis separate from the underlying official material.
01NVIDIA Newsroom: Open Agent Safety Platform — 28 September 2026Open source ↗02NVIDIA: Open Agent Safety Platform product overviewOpen source ↗03NVIDIA Technical Blog: add runtime controls with OpenShellOpen source ↗04NVIDIA OpenShell documentation and support matrixOpen source ↗05NVIDIA OpenShell source repository and Apache-2.0 licenceOpen source ↗
Safety
Safety
Safety
Safety