Nvidia OpenShell: an architecture to contain AI agents

On 21 October 2026 Nvidia introduced the OpenShell Reference Architecture, a blueprint for running AI agents in the enterprise within defined boundaries, with a separate layer that watches them and can stop them. It builds on OpenShell, the secure agent runtime Nvidia had already released, and ties it to Nvidia hardware: models, agents and controls run on different components.

The Register and Help Net Security covered the announcement and agree on the overall design; many details, however, come from only one of the two outlets and are flagged as such. heise Security also ran a feature on hardware-based agent oversight, but its text was not available for this analysis.

This is neither a vulnerability nor an incident: it is an architecture to assess for anyone bringing AI agents into business processes.

The starting problem

AI agents run commands, call APIs and use credentials. The Register recalls the security tests run by OpenAI and Anthropic, during which models went beyond their remit and attacked third-party organisations. The most popular coding agents already restrict access to tools such as curl and bash, and developers put them in sandboxes to isolate them from the host.

According to The Register, OpenShell sits a level above that: it extends sandboxing to the governance of gateway-brokered credentials, identity and policy boundaries, and eventually routing and workflows as well.

How the architecture is split

Both sources describe the same three-layer split:

• models: run on Vera Rubin systems (The Register gives Nvidia’s Nemotron models as an example);
• agents: Vera CPUs run the software that manages agents and their use of tools (the harness), with OpenShell providing the restricted environment they operate in;
• control: BlueField-4 DPUs, programmable network cards (SmartNICs), run Nvidia Sentry, the security software that monitors agent behaviour and enforces policies.

Help Net Security describes this as a separate monitoring and enforcement layer that acts through the hardware. In principle, that is the point of the design: control does not live in the same environment as the agent it oversees.

Again according to Help Net Security, Nvidia says that if an agent tries to leave its software boundary, Sentry can isolate and stop it within milliseconds, and that running Sentry on BlueField-4 increases agent capacity by up to 20%. These are vendor figures, not independently verified.

Platforms, partners and integrations

• Infrastructure: Linux and Kubernetes, according to both sources; Help Net Security adds Microsoft Windows through Microsoft Execution Containers. The clouds mentioned are Amazon Web Services, Google Cloud and Microsoft Azure.
• Linux distributions: The Register names Canonical, SUSE and Red Hat among the partners.
• Local systems: according to Help Net Security, the architecture also covers RTX Spark, DGX Spark and DGX Station, for agents working on premises in sectors such as retail, healthcare, manufacturing, robotics and telecommunications.
• Third-party agents: The Register reports that the blueprint applies to agents from Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection and SpaceX.
• Integrations: according to Help Net Security, ServiceNow AI Passport can revoke an agent’s access across software and hardware within seconds; according to The Register, SAP is integrating the architecture with its Joule Studio runtime.

Help Net Security reports that the architecture is available now.

Points to keep in mind

• Nvidia hardware required: to implement the architecture, The Register writes, organisations need Nvidia infrastructure.
• Open issues: The Register notes that OpenShell still has a few open security-related issues on GitHub.
• Telemetry on by default: again according to The Register, OpenShell collects telemetry «to improve the project», with an opt-out; Nvidia warns that third-party services, models, inference endpoints and tools used with OpenShell may have their own terms and privacy practices.
• No CVEs and no indicators are associated with this news.

Impact for European and Italian organisations

Two European banks, BBVA and Santander, are examining the OpenShell Reference Architecture: according to The Register, to see how it aligns with their security and governance requirements. In the financial sector, agents with access to systems fall under the ICT risk management required by DORA; for NIS2 entities, under the Article 21 measures: access control, security of development and of the supply chain, activity logging.

In healthcare, one of the sectors mentioned for local agents, default-on telemetry needs careful assessment under the GDPR, especially near health data.

For most Italian companies, a Vera Rubin infrastructure with BlueField-4 is not on the horizon. The principles still apply without it: whoever executes and whoever controls must sit in different places, credentials must be revocable at once, and the agent must be isolatable.

What to do now

1. Inventory the agents in use: which coding and automation agents run on workstations and servers, with which credentials and permissions, and whether any of them approve their own actions.
2. Separate execution and control: keep agent policies and logs outside the agent’s environment; have credentials delivered by a gateway or broker, never left in the agent’s environment variables.
3. Prepare fast revocation: a way to strip an agent of all credentials and network access within seconds, and test it before you need it.
4. If you assess OpenShell: read the open security issues on GitHub, decide whether to disable telemetry and check the terms of connected third-party services, test in a lab environment and do not take the vendor’s figures for granted.
5. Log agent actions to a central archive, so you can reconstruct what happened if an allowed action causes damage.

How ARXDOME helps

ARX Sentry, the ARXDOME monitoring module (not to be confused with Nvidia’s software of the same name), collects logs, events and software and process inventory from Windows, Linux and macOS computers and servers: it helps you see which AI agents and tools are actually running and spot unexpected behaviour. ARX Shield shows open vulnerabilities by package, including those of newly installed components, and lets you isolate a suspicious machine from the network and release it in a controlled way.

Last updated: 21 October 2026