NVIDIA launches OpenShell architecture for governed AI agents

NVIDIA launched the OpenShell Reference Architecture on Wednesday, introducing a stack for runtime isolation, policy enforcement and optional hardware-based monitoring of AI agents in enterprise and edge environments. The company said the reference architecture is available now; its public repository and deployment documentation were accessible when researched.

The design is intended to contain agents that can execute code, access files and call external services. It combines NVIDIA compute platforms with the OpenShell runtime and, as an optional layer, BlueField-4 data processing units running the company’s Sentry control system. NVIDIA presents this combination as a safety architecture, but its safety claims have not been independently tested.

At the software layer, NVIDIA describes four OpenShell components. A Gateway control plane manages sandboxes and policies. A Supervisor runs outside each sandbox to check outbound requests and mediate credentials. The Sandbox restricts filesystem and process access. A Policy Prover checks requested permissions against an organization-defined ceiling.

This separation is designed to keep secrets and unrestricted network access away from the agent. The sandbox has no direct network route. Authorized connections pass through the Supervisor, which can inspect, block or modify traffic, and substitute real credentials for placeholders only after a request passes policy checks. Gateway interceptors can add deployment-specific controls without modifying the Gateway. Cisco’s DefenseClaw integration description confirms the network and credential-mediation pattern and says the integration is available to try.

NVIDIA positions BlueField-4 and Sentry as a hardware-isolated enforcement plane. The company says Sentry can observe requests and responses, network and file activity, identity, delegated authority and selected host memory, then quarantine a policy-violating agent within milliseconds. Those claims about monitoring coverage and response time have not been independently verified.

The announced compute stack places model inference on Vera Rubin infrastructure, while Vera CPUs run agent harnesses and OpenShell. NVIDIA claims Vera Rubin NVL72 delivers 30 times higher throughput per megawatt on agentic workloads than its comparison baseline. It also says Vera CPUs provide up to twice the performance of x86 systems and that moving Sentry controls to BlueField-4 can increase agent capacity by as much as 20%. The company’s technical post cites CoreWeave measurements of more than three times faster sandbox startup, 1.8 times faster agent-loop completion and more than 11,000 concurrent agent environments per rack. The opened evidence did not include independent replication or enough methodology to verify those figures.

NVIDIA says OpenShell supports Linux and Kubernetes distributions, Microsoft Windows through Microsoft Execution Containers, major cloud operating environments and edge systems including RTX Spark, DGX Spark and DGX Station. The deployment documentation was public when checked, but the cross-platform claims were not independently tested. NVIDIA’s announcement also cautions that some described products and features remain subject to future availability, leaving the production-readiness and ordering status of every hardware-backed configuration unclear.

The company named model developers, security vendors, enterprise software providers, system manufacturers, cloud providers and inference services as supporters, although the full roster was not confirmed company by company. Cisco says DefenseClaw connects OpenShell controls with identity-aware policy, AI Defense guardrails and observability. ServiceNow says its Arc policy-enforcement product is generally available and enforced with OpenShell. The integration extends ServiceNow’s AI Passport governance model, but ServiceNow says enforcement of AI Passport through OpenShell and BlueField DPUs is planned for a future release. In its integration announcement, ServiceNow also claims policy revocations can propagate across the software and hardware layers in about one second. That response-time claim has not been independently verified.