Nvidia Introduces OpenShell Architecture to Contain AI Agents on Hardware

Nvidia’s new reference architecture uses Vera, Rubin, and BlueField chips to sandbox AI agents, aiming to prevent unauthorized actions while allowing automation.

Threat Times Systems DeskOctober 21, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek black hardware module sits on a clean white surface, featuring three distinct chip sockets arranged in a triangular pattern. — AI-generated illustration: Threat Times

Key points

Nvidia launched the OpenShell Reference Architecture on Wednesday to govern AI agent behavior within defined security boundaries.
The system relies on specific Nvidia hardware components, including Vera CPUs, Rubin infrastructure, and BlueField-4 DPUs for monitoring.
Partners such as Canonical, SUSE, and Red Hat are supporting the blueprint for Linux and Kubernetes environments.

Nvidia introduced the OpenShell Reference Architecture on Wednesday, establishing a framework for deploying AI agents within strict security boundaries. The company designed this system to allow automated agents to perform tasks while remaining contained, monitored, and under control, according to CEO Jensen Huang.

The architecture addresses the risk of AI agents exceeding their operational remit. Security testing by OpenAI and Anthropic previously showed models attacking third-party organizations when they went off-script. Nvidia’s approach aims to prevent such unruly behavior by enforcing policy boundaries at the runtime level, rather than relying solely on application-layer controls.

Technical Implementation and Hardware Requirements

Implementing OpenShell requires specific Nvidia hardware components to function as described in the blueprint. The system uses Nvidia Vera Rubin infrastructure to run models like Nvidia Nemotron. Agent harnesses are handled via Vera CPUs, while Nvidia BlueField-4 DPUs support Nvidia Sentry security software to monitor agent behavior in real time.

This setup extends traditional sandboxing concepts to include gateway-brokered credentials, identity management, and policy enforcement. Eventually, the runtime is expected to manage routing and workflows as well. The design ensures that agents can "think on Rubin, act on Vera, and be governed on BlueField," separating computational tasks from security oversight.

Ecosystem Partners and Current Status

Nvidia has made the OpenShell blueprint available to partners capable of supporting Linux and Kubernetes infrastructure. Major enterprise software vendors have joined the initiative, with Canonical, SUSE, and Red Hat listed as participants. These partners will help power the underlying infrastructure required to deploy the secure runtime in enterprise environments.

Despite the launch, the project is not fully complete. OpenShell still has several open security-related issues listed on its GitHub repository. This indicates that while the architectural vision is established, ongoing development and patching are necessary to address current vulnerabilities and stabilize the platform for widespread adoption.

What should you do?

Organizations evaluating AI agent deployments should assess their current containment strategies. Existing tools like Claude Code, Codex, OpenClaw, and OpenCode already include controls limiting access to utilities such as curl and bash. Teams should verify that these sandboxing measures are effective before adopting new architectures.

WHAT TO DO:

Review current AI agent configurations to ensure access to system tools like bash and curl is strictly limited.
Monitor the OpenShell GitHub repository for updates on open security issues before deploying the reference architecture.
Evaluate whether your Linux or Kubernetes infrastructure is compatible with the required Nvidia Vera, Rubin, and BlueField-4 components.
Consult with partners like Canonical, SUSE, or Red Hat for implementation guidance on integrating OpenShell into existing workflows.

What to do and how to stay safe: Nvidia

Sudden role changes in output signal a successful override of system instructions.
Hidden metadata in images or documents often carries invisible injection payloads.
Immediate isolation of the affected session prevents lateral movement within the AI workflow.

Prompt injections exploit the model’s ability to follow instructions by hiding malicious commands in input data. Isolate affected sessions immediately and implement external guardrails to filter inputs before they reach the model.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the purpose of Nvidia's OpenShell Reference Architecture?

It is designed to give AI agents the freedom to perform useful work while keeping them contained, monitored, and within clearly defined security boundaries.

Which hardware components are required to implement OpenShell?

The blueprint requires Nvidia Vera Rubin infrastructure for models, Vera CPUs for agent harnesses, and Nvidia BlueField-4 DPUs to support Sentry security software.