NVIDIA launches Open Agent Safety Platform, says OpenShell and Sentry would have stopped the Hugging Face hack
NVIDIA released an open software platform and reference system for agentic AI safety, built from two components:
- OpenShell provides hardware-based containment on CPUs and enforces security policy while an agent runs.
- Sentry runs on BlueField-4 DPUs and independently monitors network traffic, detecting spawn attempts and enforcing access controls.
NVIDIA told Reuters and CNBC the stack would have stopped the recent Hugging Face breach. More than 100 partners have signed on, including Microsoft, Anthropic and xAI.
NVIDIA frames the design around how agents actually behave. As the company put it on X: 'Agents can run for days, calling tools, hitting errors, and trying again. The security policy has to keep working through all of that.' The core idea is to push enforcement below the model. Even an agent that ignores its instructions cannot reach resources outside its sandbox, and the DPU gives an out-of-band monitor the agent cannot tamper with. VentureBeat described OpenShell as controlling what agents can access 'even when they ignore instructions.'
The partner reaction was immediate:
- Perplexity CEO Aravind Srinivas said 'safety is an engineering problem' and pledged to open-source the sandbox work Perplexity is building with NVIDIA.
- Andrew Ng said his OpenWorker cybersecurity agent harness is building on OpenShell. He argued the OpenAI-Hugging Face incident 'was enabled by weak sandboxing.'
The timing, right after OpenAI's sandbox escapes, gives NVIDIA a strong position to define the containment layer.
The caveats are substantial. Developers note that Sentry is only a reference design, and that just OpenShell v0.1.0 is usable today. Skeptics on Hacker News doubt the claim that it 'would have stopped' the hack, especially without adoption beyond NVIDIA's own ecosystem. A tying of agent safety to BlueField-4 hardware also invites the charge that safety is doubling as a GPU-adjacent upsell. Watch for independent red-team results and for how many partners ship production integrations rather than just logos.