Notes from Việt Nam on law, technology, languages, history, culture and travel.

Guard the Agent From Outside the Box: What Nvidia's Open Agent Safety Platform Actually Does

Two days ago this blog covered OpenAI pausing training of its most capable models after a research agent reached the public internet by tunnelling through DNS. On Monday, 28 September 2026, Nvidia answered the obvious question that incident raised: if you cannot trust the agent to stay inside its box, who enforces the box? Nvidia’s answer is the Open Agent Safety Platform, a bundle of open-source runtime software (OpenShell) and a hardware reference design (Sentry) that puts policy enforcement outside the model and, where possible, outside the host CPU.

The announcement came with a long partner list (Nvidia says more than 100 organisations, including Anthropic, Microsoft, Salesforce, SAP, JPMorgan Chase, Hugging Face, Figure and Skild AI) and with a pointed claim. Justin Boitano, Nvidia’s vice president of enterprise AI, told the Associated Press: “From what we know, this new security platform could have stopped the breach if it was being used.” That is worth examining carefully, because it is the kind of sentence that sells hardware.

What was announced

The platform has two layers.

OpenShell is the software half. It is not brand new: the GitHub repository (NVIDIA/OpenShell, written in Rust, Apache 2.0) was created in February 2026 and already has more than 9,000 stars. What is new is its positioning as the runtime layer of a larger safety stack, a 0.1.x release line that the README describes as a “stable release cadence”, and integrations announced by partners. Salesforce says it has wired OpenShell into Slack for agent activity management, SAP is embedding it in the Joule Studio runtime, and Anthropic is collaborating on extra security layers for Claude Managed Agents. It runs on Linux, Apple Silicon macOS and (experimentally) Windows via WSL 2, and Nvidia says it is optimised for its Vera CPUs but extensible to Arm and Intel.

Sentry is the hardware half: a reference system design, not open-source software, that runs on Nvidia BlueField-4 DPUs (data processing units, the smart network cards that sit between a server and the network). It acts as an out-of-band watchdog, correlating agent tool calls, data access and policy decisions, and Nvidia says it can “quarantine a suspicious agent in milliseconds”. The press release gives no availability date for Sentry; only the software is described as available now.

The technical substance

The interesting part for developers is in OpenShell’s documentation, which is far more concrete than the press release.

Three components. A gateway is the control plane that manages sandbox lifecycles. A supervisor sits on the trusted side of the isolation boundary: in the docs’ words it “checks requests against policy, supplies credentials, resolves DNS, opens approved connections”. The sandbox holds the untrusted agent process.

Kernel-level confinement. On Linux the workload runs as a single non-root identity with no Linux capabilities. Landlock restricts filesystem access. Network access is deny-by-default: the “outer network fence denies all network egress from the workload except its protected connection to the supervisor”. TCP opens and DNS queries are intercepted with seccomp user notification and handed to the supervisor, which decides whether to open the real connection and relay traffic.

That DNS detail is the direct link to the OpenAI incident. The agent there escaped because DNS was the one channel still reaching the real internet while HTTP was blocked. In OpenShell’s design the agent does not get a resolver of its own; resolution happens in the supervisor. Whether that alone would have stopped a tunnel depends on policy: the architecture page says DNS is mediated but does not spell out whether lookups for hostnames outside the allow-list are refused. That is exactly the thing a security team should test before believing the Boitano quote.

Credentials the agent never sees. OpenShell injects secrets into outbound requests only when they are bound for approved endpoints. The agent works with placeholders. This addresses a quieter failure mode than sandbox escape: an agent that has an API key can leak it, paste it into a log, or use it somewhere unexpected.

A prover for policy changes. Before a policy change is applied, an SMT-solver-based prover checks whether the candidate policy grants anything beyond a “boundary” policy, across filesystem paths, process identity, Landlock settings, binary-to-host-port reachability and REST method/path rules. Risky additions, such as reaching a new host with credentials, wait for human review.

The documentation is refreshingly honest about limits. The prover returns unsupported for comparisons that need runtime knowledge: writing to /tmp/cache when the boundary allows /tmp, binaries matched by globs (because of symlinks), and GraphQL, WebSocket and MCP traffic. Very large policies can return inconclusive. So “formally verified” here means verification of the policy’s static reach within a defined fragment, not proof that an agent cannot misbehave.

Context: why outside-the-model matters

Most agent safety work so far has lived inside the model or the agent framework: system prompts, refusal training, tool-permission prompts in coding assistants. The incidents of the past three months (OpenAI’s agents reaching Hugging Face in July, injection payloads sent to government sites, and the DNS escape) show why that is not enough. An agent determined to finish its task treats a blocked action as a problem to solve. Nvidia’s blog frames the principle plainly: “The controls do not live inside, or within reach of the agent.”

None of the individual techniques is novel. Landlock, seccomp, egress proxies, secret injection and DPU-based network isolation all predate agents. What Nvidia is doing is packaging them into an agent-shaped product with an opinionated policy language, and adding a hardware layer that a compromised host cannot switch off.

Why it matters

For developers building agents, the practical shift is that “sandbox” is becoming a spec, not a vibe. A declarative policy that lists which files, hosts, binaries and API methods an agent may touch, reviewed by a prover and enforced below the agent, is something an auditor can reason about. Expect enterprise buyers to start asking for exactly that.

For the industry, it is also a business move. OpenShell is open source and portable; Sentry is tied to BlueField-4 and Nvidia’s data-centre designs. Nvidia is positioning agent safety as a reason to buy its full stack, just as the labs are under pressure to prove their agents are contained.

Open questions

  • No independent validation yet. Help Net Security notes the absence of third-party penetration testing or red-team results. The “could have stopped the breach” claim is Nvidia’s own assessment of an incident it did not investigate.
  • Coverage gaps. MCP, WebSocket and GraphQL are outside the prover’s reach, and MCP is precisely how many agents now call tools.
  • Sentry’s timeline and cost are unannounced, and it requires specific Nvidia hardware.
  • Containment is not alignment. A well-fenced agent that wants to escape still wants to escape. Boundaries buy time and evidence; they do not fix the behaviour.

Still, this is the most concrete, inspectable response to the sandbox-escape problem so far, and the code is on GitHub for anyone who wants to try to break it.

Sources