Have a project in mind? Let's talk.
NVIDIA OpenShell is now a full reference architecture, not just a runtime. Announced on October 21, 2026 at GTC Berlin, the NVIDIA OpenShell Reference Architecture is a complete stack for building, containing, observing, and enforcing safe AI agents on enterprise infrastructure and edge systems. It pairs the open-source OpenShell runtime with new NVIDIA hardware: Vera Rubin systems for model inference, Vera CPUs for agent harnesses, and BlueField-4 DPUs running NVIDIA Sentry for enforcement in silicon. The partner list is long: Anthropic, AWS, Google Cloud, Meta, Microsoft, OpenAI, SAP, ServiceNow, CrowdStrike, Palo Alto Networks, and banks including BBVA and Santander are among those working with it. NVIDIA Newsroom announcement
This post breaks down what NVIDIA actually announced, how the pieces fit together, and what the design teaches any team shipping agents, whether or not NVIDIA hardware is in your future.
The headline idea is that agent safety becomes an infrastructure property. Jensen Huang framed it directly: "AI capability and safety must advance together. As enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture." His summary of the stack: agents think on Rubin, act on Vera, and are governed on BlueField. NVIDIA Newsroom announcement
Concretely, the reference architecture has four pillars. Vera Rubin infrastructure (with the NVL72 at its core) runs the models, delivering what NVIDIA claims is 30x higher throughput per megawatt on agentic workloads. Vera CPUs run the agent harnesses and tool use. OpenShell, the open-source runtime, defines what agents are allowed to do. BlueField-4 DPUs run NVIDIA Sentry, a security framework that watches agent behavior from outside the operating system and can quarantine an agent in milliseconds. The same architecture extends to the edge through RTX Spark, DGX Spark, and DGX Station systems. NVIDIA Newsroom announcement
It is also deliberately not a closed club. The architecture runs on Canonical, SUSE, and Red Hat Linux with Kubernetes, on Microsoft Windows using Microsoft Execution Containers, and on AWS, Google Cloud, and Azure. NVIDIA says it is available now. NVIDIA Newsroom announcement
The most important design decision is stated plainly in NVIDIA's technical blog: "An agent cannot govern itself. Security and governance belong in the infrastructure the agent operates in." OpenShell therefore treats agent workloads as untrusted throughout execution, granting each agent access to what it needs, when it needs it, and nothing more. Source
OpenShell has four components, and the separation between them is the point. The Gateway is the control plane that manages sandbox lifecycles and policies. The Supervisor checks every outbound request against policy and mediates access to credentials, and it runs completely separate from the sandbox, so a compromised agent cannot rewrite its own permissions. The Sandbox isolates the workload and restricts filesystem and process access. The Policy Prover adds formal verification, checking whether a policy's permissions stay within an organization-defined ceiling before the policy is ever applied. Source
The runtime itself is open source under Apache 2.0, with an active repository that passed 17,000 stars, and extension hooks are built in: Supervisor middleware can inspect, block, or change the content an agent sends and receives over the network, and Gateway interceptors let operators add deployment-specific governance without forking the control plane. NVIDIA OpenShell on GitHub
The documentation describes the resulting security posture as three layers: controls at the workspace perimeter, enforcement around the agent runtime (OS-level process, filesystem, and network controls plus trusted credential mediation), and signed-policy governance, which means policies go through controlled authoring, release, verification, and audit like code does. Each layer covers failure modes the others cannot. NVIDIA Secure Agent Workspace docs
Software boundaries can be attacked by the very compute they run on. The optional second tier of the architecture moves enforcement off the host entirely. BlueField-4 DPUs sit in the I/O path between agents running on Vera and the models they call, creating a hardware-isolated trust domain outside the agent's reach. NVIDIA Sentry, built on the DOCA software framework, runs there and continuously monitors requests and responses, network and file activity, identity and delegated authority, and selected host memory, without relying on the agent to report its own behavior. Source
When Sentry detects a policy violation or threat, BlueField-4 enforces policy in silicon and can quarantine the agent in milliseconds. NVIDIA also claims a performance side benefit: offloading this monitoring to the DPU boosts agent capacity by up to 20% compared to burning host CPU cycles on it. NVIDIA Newsroom announcement
NVIDIA's case for Vera CPUs is that agent workloads are unlike serving workloads. Agents run loops of dependent steps (reason, call a tool, execute code, query data, repeat), and thousands of these loops run concurrently. That demands high core counts, fast single-thread performance for sequential steps, huge memory bandwidth for live context, and hardware isolation between tenants. Vera packs 88 Olympus cores, a second-generation Scalable Coherency Fabric with up to 3x core-to-core bandwidth, up to 1.2 TB/s of LPDDR5X memory bandwidth, and 96 lanes of PCIe Gen 6, with a claimed 2x performance and 2x performance per watt versus x86 on agentic workloads. Source
The most credible numbers come from CoreWeave, which measured OpenShell sandboxes on Vera against a leading x86 CPU: more than 3x faster sandbox startup, 1.8x faster completion across 20 real agentic tasks on Terminal Bench, and a single rack supporting more than 11,000 concurrent agent environments. Sandbox startup speed matters because every agent task begins inside a fresh isolated environment; at fleet scale, slow sandbox startup is a tax on every single action. Source
The adoption list spans every layer of the market. Model builders Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection, and SpaceX Super Intelligence can run on OpenShell infrastructure. Security vendors 1Password, Check Point, Cisco, CrowdStrike, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI, and Zscaler are integrating it into their agent security products. System makers Dell, Cisco, HPE, Lenovo, and Supermicro are building infrastructure with it, and cloud providers from CoreWeave and Lambda to Oracle Cloud Infrastructure and Vultr plan OpenShell-ready capacity. NVIDIA Newsroom announcement
Two integrations show the direction best. SAP is connecting the OpenShell Reference Architecture to its Joule Studio runtime so business governance maps to secure agent execution. ServiceNow announced general availability of Arc, a personal long-running agent whose actions are governed at runtime by its Super Intelligence Control Tower and enforced by OpenShell; its AI Passport layer can revoke an agent's access across software and hardware within seconds. Banks BBVA and Santander are exploring the architecture as a framework for agent safety and governance. NVIDIA Newsroom announcement
You do not need a Vera rack to use the ideas. The reference architecture validates a pattern any team can apply with ordinary infrastructure, and it sets the vocabulary your customers, auditors, and security reviewers will start using.
First, authority must live outside the agent. OpenShell's Supervisor holds credentials and checks requests precisely because a goal-oriented agent under prompt injection or task pressure cannot be trusted to police itself. If your agent holds its own API keys and decides its own scope, your design is behind the curve. Our guide to ungoverned agentic AI covers the risk model in detail.
Second, identity and revocation are becoming runtime features. ServiceNow's AI Passport revoking access in seconds is the new bar. Your agents need identities, scoped authority per task, and a kill path that does not depend on the agent cooperating. The OWASP agentic AI Top 10 maps the failure modes this prevents.
Third, policy deserves the same rigor as code. Signed-policy governance (authoring, review, release, verification, audit) is how mature teams will treat agent permissions from now on. If your agent policies live in a prompt, they are not policies. Our AI agent security checklist is a practical starting pass, and the MCP server security best practices post covers the tool layer where most agent authority actually executes.
The bigger signal: with NVIDIA, the security vendors, the clouds, and the model builders aligning on one pattern, "contained, monitored, and under control" stops being a differentiator and becomes table stakes. Teams that build governance in now will sell into enterprise procurement far more easily than teams that bolt it on later.
NVIDIA OpenShell is an open-source runtime (Apache 2.0) that enforces security and governance for autonomous AI agents. It treats agent workloads as untrusted, isolates them in sandboxes, mediates their access to credentials and networks, and formally verifies the policies that govern them. The OpenShell Reference Architecture, announced October 21, 2026, extends it into a full hardware and software stack with NVIDIA Vera CPUs, Vera Rubin systems, and BlueField-4 DPUs.
The OpenShell runtime software is open source under the Apache 2.0 license and available on GitHub. The full reference architecture pairs it with NVIDIA hardware (Vera CPUs, BlueField-4 DPUs, Vera Rubin systems), which is commercial infrastructure sold through NVIDIA and partners including Dell, HPE, Lenovo, and major cloud providers.
No. The core pattern (sandbox the agent, hold credentials in an external supervisor, verify policies before applying them, monitor from outside the agent) works on ordinary infrastructure. BlueField-4 and Sentry add a hardware-isolated enforcement tier for organizations that need assurance software alone cannot give, such as banks and regulated industries.
NVIDIA Sentry is a security software framework built on NVIDIA DOCA that runs on BlueField-4 DPUs, physically separate from the host running the agent. It continuously monitors agent behavior, verifies identity and delegated authority, and can quarantine an agent in milliseconds when it detects a policy violation, without depending on the agent to report its own actions.
NVIDIA lists Anthropic, OpenAI, Meta, Google Cloud, AWS, Microsoft, SAP, ServiceNow, Palantir, and SpaceX Super Intelligence among those working with it, along with security vendors like CrowdStrike, Palo Alto Networks, Okta, and Zscaler, banks including BBVA and Santander, and cloud providers including CoreWeave, Oracle Cloud Infrastructure, Lambda, and Vultr.
Ready to take the first step towards unlocking opportunities, realizing goals, and embracing innovation? We're here and eager to connect.