NVIDIA Open Agent Safety: OpenShell 0.1.0 + BlueField-4 Sentry — Runtime Policy, Milliseconds Quarantine

Last night’s JEV-27B note was a System 1 decision ticket: typed yes/no · choice · 0–5 on a frozen Qwen3.8-27B, KL ≈0.017, one B200. Yesterday morning’s Holo4 was a computer-use $/task ticket: GUI + code + MCP with open trajectories. Agents still need a third board — what the process is allowed to touch at runtime, and what stops it when it steps outside. On September 28, 2026, NVIDIA launched the Open Agent Safety Platform: open-source OpenShell 0.1.0 plus Sentry, a reference-design watchdog on BlueField-4 DPUs.

Primary sources: NVIDIA investor PR (Sep 28), OpenShell blog, Sentry / in-silicon blog, product page, SecurityWeek, NVIDIA/OpenShell, docs. Numbers below are NVIDIA’s (or SecurityWeek’s restatement). Treat sandbox-speed and adversarial-test rows as vendor claims until you reproduce them.

Spec sheet (named numbers)

Partners (brief, not the story): Anthropic Claude Managed Agents + OpenShell/BlueField; Salesforce Slack audit/approve; SAP Joule Studio; >100 orgs; Open Secure AI Alliance / Linux Foundation SAFE.

What actually changed for people who run agent fleets

The durable product change is a split control plane: open runtime policy around the agent process, plus an optional out-of-band DPU that can quarantine when software review is not enough.

OpenShell’s three pieces are explicit. The Gateway owns fleet lifecycle and policies. The Supervisor sits outside the workload and checks outbound traffic against policy — inspect HTTP, GraphQL, and MCP; allow read while blocking write on the same API. The Sandbox enforces kernel-level filesystem and process isolation; the workload has no network except through the supervisor. That is a different purchase from “prompt the model to be careful.”

Credentials follow the same split: the agent sees a placeholder; the real key is substituted outside the workload only for authorized endpoints. A policy advisor can propose policy changes but cannot approve its own requests (human review by default). A policy prover runs formal logic checks so modeled permissions stay inside the operator boundary.

Sentry is the hardware layer: out-of-band on BlueField-4, in-silicon enforcement on NVIDIA DOCA — inspect requests/responses, attested telemetry, verify agent identity, zero-trust policies for data/tools/APIs/services. NVIDIA says it quarantines or stops agents outside the boundary in milliseconds. In a Vera Rubin POD, each compute tray includes BlueField-4 on the node’s only path to the model, with line-speed OOB observability; a software update enables existing Vera + BlueField-4 systems. OpenShell does not require that DPU — start on Docker / Podman / MicroVM / Kubernetes and add Sentry where the path justifies it.

Vendor claims vs what you should not invent

Adversarial review test (NVIDIA): frontier agents with reduced safeguards spent up to two hours trying to persuade an AI reviewer to grant permissions to modify a protected GitHub repo. Combined review + runtime → no protected repository writes in those tests. Named vendor harness, not an independent red-team leaderboard — reproduce before you retire your own gate.

Vera sandbox performance (NVIDIA product page): up to 80% faster sandbox performance than traditional CPU infrastructure — vendor claim. OpenShell is optimized for Vera and extendable to Arm and Intel; do not invent Arm/Intel speedups.

Sentry latency (NVIDIA): quarantine/stop in milliseconds. No finer percentile table here — do not invent p50/p99.

Do not invent AA Index rows, OSWorld scores, token prices, or third-party bake-offs. Those live on Holo4, JEV-27B, MiMo, and the closed-agent posts.

Where it sits next to Holo4, JEV, Inferra, Leo X, Continuum, and closed agents

Holo4 answers what the agent does on the desktop. JEV-27B answers how you gate micro-decisions. OpenShell + Sentry answer which tools, repos, and credentials the process may touch, and how fast you cut it off. Different SKUs; same fleet. Inferra / Leo X / Continuum remain memory and fabric CapEx.

Caveats I would write into any OpenShell / Sentry ticket

1. Vendor adversarial test ≠ independent red team. The two-hour persuasion run and “no protected repository writes” are NVIDIA’s. Re-run against your repo and reviewer stack.
2. “Up to 80% faster” is a Vera product-page claim. Do not paste it as an Arm/Intel result or your measured sandbox gain.
3. Milliseconds has no published percentile table. Plan for order-of-magnitude OOB stop, then measure on BlueField-4.
4. OpenShell ≠ Sentry. Software runs without the DPU; Sentry is optional in-silicon. Quote which tier you are buying.
5. OPA/Rego is only as good as the YAML. Policy advisor proposals still need human approval by default.
6. Credential substitution is a trust boundary. Audit who changes authorized endpoints and who rotates the outside-workload secret store.
7. Not a rematch of Holo4 / JEV / Inferra / Leo X. This is runtime + DPU enforcement, not computer-use VLMs, decision adapters, or KV/optics CapEx.

How I would evaluate if I ran agent fleets with tool and repo access

1. Software-only canary — OpenShell 0.1.0 on Docker or Kubernetes with a tight YAML policy: allow read on a staging API, deny write; confirm Supervisor blocks the write and OCSF records it.
2. Credential placeholder drill — prove the agent never sees the real key, and substitution only fires for listed endpoints.
3. Policy advisor / prover loop — agent proposes an expansion; human approves; prover keeps modeled permissions inside your boundary.
4. Sentry only where BF-4 is already on the node — especially Vera Rubin trays where BlueField-4 is the only path to the model; measure quarantine on a deliberate violation before trusting milliseconds in production.
5. Keep the other boards separate — Holo4 for computer-use $/task, JEV-27B for System 1, Sol / Opus 5.5 for hard unattended coding, Inferra / Leo X / Continuum for memory fabric. OpenShell is the runtime policy board.

This is an open agent runtime + optional in-silicon watchdog with named OpenShell 0.1.0 components, OPA/Rego + OCSF, credential substitution, a vendor adversarial GitHub-write test, and BlueField-4 Sentry in milliseconds — not a chat flagship and not an AA rematch. Put OpenShell where every agent hop can reach a repo, API, or secret. Add Sentry where BlueField-4 already sits on the model path. Keep Holo4 on computer-use, JEV-27B on System 1, MiMo on the open ceiling/price row, DeepSeek-V4.1-Flash on cacheable API loops, AliceAI on from-scratch bases, and Sol / Opus 5.5 on hard unattended work until your policies and measurements say otherwise. Measure, then move the control plane.

Create-only. Specs from NVIDIA’s Sep 28 investor PR, OpenShell and Sentry developer blogs, agent-safety product page, SecurityWeek Sep 28, and OpenShell 0.1.0 GitHub/docs. Update when a named third party reproduces the adversarial GitHub-write test, when Vera sandbox numbers land outside NVIDIA’s product page, or when OpenShell publishes finer Supervisor latency tables.

Sources: NVIDIA investor PR (Sep 28) · OpenShell blog · Sentry / in-silicon blog · product page · SecurityWeek · NVIDIA/OpenShell · docs.

Anpoo Sivanadi, Staff Software Engineer