ServiceNow and Nvidia make Arc AI agent generally available with security guardrails

ServiceNow and Nvidia announced on Wednesday that their joint AI agent, Arc, is now generally available for enterprise use. The product was originally introduced in May, and this release marks its transition to a fully supported state for business customers seeking automated workflow assistance.

The agent is designed to handle routine daily tasks within productivity environments such as email and Microsoft Teams. According to ZDNET, ServiceNow and Nvidia describe Arc as a personal, long-running AI agent capable of managing everyday work. It is currently available for Mac computers, while support for Windows systems remains under development and has not yet been released.

Security and Governance Framework

Addressing concerns about autonomous AI systems following recent security incidents, the companies built a multi-level security infrastructure around Arc. ZDNET reports that ServiceNow and Nvidia aim to solve the AI agent security conundrum by implementing real-time checks. The goal is to provide businesses with confidence that their data and operations remain protected while using autonomous tools.

Arc is governed by the ServiceNow Super Intelligence Control Tower, which serves as a comprehensive monitoring service. This framework tracks agent activities, validates access permissions, and scans for security risks including prompt injection attempts. It also measures overall agent performance to ensure consistent and reliable operation within the enterprise environment.

Enforcement occurs at the runtime and hardware levels using Nvidia OpenShell, an open-source tool. By moving security controls beyond the traditional software layer, the companies claim to offer more reliable protection. This approach allows the agent to function independently while maintaining strict enterprise oversight and control over its actions.

Hardware and Operational Capabilities

Arc is optimized for Nvidia’s new RTX Spark devices, allowing it to run efficiently on employee desktops or dedicated hardware. The agent can operate locally, keeping data on the device whenever possible, or within the OpenShell environment. This design prioritizes data locality, sending information to external frontier models only when complex tasks require additional computational power.

The agent builds memory and skills over time, improving its performance as it accumulates context from daily interactions. It proactively identifies work items by scanning employee inboxes and meeting notes. This continuous learning model enables Arc to adapt to individual user workflows and organizational needs without constant manual intervention.

What should you do?

Organizations considering autonomous AI agents should evaluate the security controls provided by vendors before deployment. It is essential to verify how data is handled, especially when agents scan emails or access productivity tools. Teams should monitor agent activities closely to detect any unexpected behavior or access requests.

Background: Prompt injection attacks

Look for sudden shifts in tone, refusal to follow system constraints, or output that repeats hidden instructions. These signs indicate the model is processing injected commands rather than your intended query.

Read the full guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

What to do and how to stay safe: ServiceNow

• Review the vendor’s documentation on data locality and ensure sensitive information remains on local devices whenever possible.
• Verify that the AI agent integrates with existing enterprise governance frameworks to maintain visibility into its actions.
• Monitor agent permissions and access logs regularly to detect any anomalies or unauthorized data access attempts.
• Test the agent in a controlled environment before full deployment to assess its impact on workflow and security posture.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

When is the Windows version of the Arc AI agent available?

Windows support is not yet available; ServiceNow and Nvidia have only released the Mac version as of the general availability announcement.

What security framework governs the Arc agent?

Arc is governed by the ServiceNow Super Intelligence Control Tower, which monitors activities, vets access, and checks for risks like prompt injection.

How does Arc handle data privacy?

The agent keeps data local on employee devices or dedicated hardware whenever possible, only sending complex tasks to external frontier models when necessary.