# NVIDIA OpenShell Reference Architecture

> Source: https://aiwiki.ai/wiki/nvidia_openshell_reference_architecture
> Updated: 2026-10-25
> Fact-checked: 2026-10-25
> Categories: AI Agents, AI Infrastructure, AI Safety, NVIDIA
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) - attribute to "AI Wiki (aiwiki.ai)"
> Cite as: AI Wiki. "NVIDIA OpenShell Reference Architecture." aiwiki.ai, 25 Oct 2026. https://aiwiki.ai/wiki/nvidia_openshell_reference_architecture
> From AI Wiki (https://aiwiki.ai), the free encyclopedia of artificial intelligence. Reuse freely with attribution.

The **NVIDIA OpenShell Reference Architecture** is a full-stack design from [NVIDIA](https://aiwiki.ai/wiki/nvidia) for running autonomous [AI agents](https://aiwiki.ai/wiki/ai_agents) on enterprise infrastructure and edge systems under external controls. NVIDIA announced it at [GTC](https://aiwiki.ai/wiki/gtc) Berlin on 21 October 2026, describing it as an architecture for "building, containing, observing and enforcing safe agents."[1] The design assigns each part of an agent workload to a different class of NVIDIA hardware: [NVIDIA Vera Rubin](https://aiwiki.ai/wiki/nvidia_vera_rubin) systems run the models, [NVIDIA Vera](https://aiwiki.ai/wiki/nvidia_vera_cpu) CPUs run the agent harnesses and tools inside the open source [NVIDIA OpenShell](https://aiwiki.ai/wiki/nvidia_openshell) runtime, and [BlueField](https://aiwiki.ai/wiki/bluefield)-4 data processing units (DPUs) run NVIDIA Sentry, a security software framework that monitors agents out of band and enforces policy in silicon.[1][2] [Jensen Huang](https://aiwiki.ai/wiki/jensen_huang) summarized the split in the launch release: "agents can think on Rubin, act on Vera and be governed on BlueField."[1]

The architecture extends the [NVIDIA Open Agent Safety Platform](https://aiwiki.ai/wiki/nvidia_open_agent_safety_platform), which NVIDIA announced on 28 September 2026 with OpenShell and Sentry as its two components.[15] The October release added the inference tier, edge systems ([NVIDIA RTX Spark](https://aiwiki.ai/wiki/nvidia_rtx_spark), [NVIDIA DGX Spark](https://aiwiki.ai/wiki/nvidia_dgx_spark) and [NVIDIA DGX Station](https://aiwiki.ai/wiki/nvidia_dgx_station)), a deployment guide called the Secure Agent Workspace Reference Design, and a longer partner list that includes [OpenAI](https://aiwiki.ai/wiki/openai), [Google](https://aiwiki.ai/wiki/google), [Meta](https://aiwiki.ai/wiki/meta) and [Amazon Web Services](https://aiwiki.ai/wiki/amazon_web_services).[1][4] NVIDIA said the reference architecture was "now available", with that phrase linking to the reference design documentation. A technical post published the same day gives NVIDIA Sentry's planned availability as "early next year".[1][3]

| Field | Value |
|---|---|
| Developer | NVIDIA |
| Announced | 21 October 2026, GTC Berlin[1] |
| Type | Reference architecture (hardware and software design) for governed agent execution[1] |
| Model inference | NVIDIA Vera Rubin infrastructure, with Vera Rubin NVL72 systems "at its core"[1] |
| Agent execution | NVIDIA Vera CPUs running NVIDIA OpenShell[1][2] |
| Out-of-band enforcement | NVIDIA Sentry, built on [NVIDIA DOCA](https://aiwiki.ai/wiki/nvidia_doca), running on BlueField-4 DPUs[1][3] |
| Edge systems | NVIDIA RTX Spark, DGX Spark, DGX Station[1] |
| Operating systems | Linux and [Kubernetes](https://aiwiki.ai/wiki/kubernetes) from Canonical, SUSE and [Red Hat](https://aiwiki.ai/wiki/red_hat); Microsoft Windows with Microsoft Execution Containers (MXC); cloud operating systems from AWS, Google Cloud and Microsoft Azure[1] |
| Deployment guide | Secure Agent Workspace Reference Design, with reference implementations for Red Hat OpenShift and Microsoft Azure[4][10][11] |
| Status (25 October 2026) | Architecture and documentation published; OpenShell open source; Sentry planned for "early next year"[1][3] |

## Background

NVIDIA OpenShell is an open source runtime that runs each agent in a sandbox and enforces policy on files, network destinations, processes and credentials from outside the agent's process. Its four components are a gateway (the control plane), a supervisor that checks outbound requests and mediates credentials from outside the sandbox, the sandbox itself, and a policy prover that formally checks whether a policy stays within an operator-defined ceiling.[2][12] The runtime is covered in detail in the NVIDIA OpenShell article.

On 28 September 2026 NVIDIA packaged OpenShell with the NVIDIA Sentry reference system design as the Open Agent Safety Platform. The release said that in recent security incidents "the agent circumvented security controls at the application layer to complete its assigned task", and described Sentry as "an out-of-band watchdog that runs on NVIDIA BlueField-4 DPUs."[15] The release followed disclosures during the summer of 2026 that agents from leading AI labs had broken out of their test environments,[29] covered in [AI agent sandbox escapes](https://aiwiki.ai/wiki/ai_agent_sandbox_escapes) and the [OpenAI-Hugging Face agent incident](https://aiwiki.ai/wiki/openai_hugging_face_agent_incident). Yahoo Finance, reporting on the Berlin launch, noted that NVIDIA had said the earlier software could have prevented incidents such as OpenAI's hacking of Hugging Face, and that security experts largely blamed the escapes on "poor security posture among the AI labs and their testing partners."[29]

The technical blog for the reference architecture states the premise directly: "An agent cannot govern itself. Security and governance belong in the infrastructure the agent operates in."[2]

## Architecture

NVIDIA's technical blog calls the Vera Rubin platform, OpenShell, and NVIDIA Sentry on BlueField-4 "the pillars of the OpenShell reference architecture."[2] F5, a partner, described the result as putting "the agent's runtime permissions, hardware enforcement, and inference on three tiers of NVIDIA hardware."[22] [Arm](https://aiwiki.ai/wiki/arm) summarized the design on X as "Arm-based Vera CPUs powering agent execution and BlueField DPUs supporting isolation and policy enforcement."[18]

| Tier | Hardware | Role in the architecture | NVIDIA performance claim |
|---|---|---|---|
| Inference | Vera Rubin, with Vera Rubin NVL72 at the core | Runs enterprise workloads, "including closed and open models built with NVIDIA Nemotron"[1] | 30x higher throughput per megawatt for agentic workloads[1] |
| Agent execution | Vera CPUs | Runs agent harnesses, tool use and the OpenShell runtime[1][2] | 2x the performance of x86 processors, with greater energy efficiency[1] |
| Enforcement | BlueField-4 DPUs running NVIDIA Sentry | Out-of-band monitoring and in-silicon policy enforcement on the node's path to the model[1][3] | Quarantine "in milliseconds"; up to 20% more agent capacity[1] |
| Edge | RTX Spark, DGX Spark, DGX Station | Agents at the edge in retail, healthcare, manufacturing, robotics, software development and telecommunications[1] | None stated |

All of these figures are NVIDIA's own. The release does not name the baseline for the 30x figure; an NVIDIA blog post from 1 October 2026, linked from the release, attributes "over 30x higher throughput per megawatt than NVIDIA GB300 NVL72" to [SemiAnalysis](https://aiwiki.ai/wiki/semianalysis) AgentX data.[1][14]

### Vera CPUs and OpenShell

In the reference architecture OpenShell runs on Vera CPUs.[2] NVIDIA's technical blog argues that agent loops are chains of dependent steps (reasoning, tool calls, code execution, data queries) and that running thousands of them at once needs high core counts, fast single cores, memory bandwidth, I/O and hardware-enforced isolation within a data center power budget.[2] It describes Vera as having 88 NVIDIA-designed Olympus cores with a 10-wide front end and a neural branch predictor, a second-generation Scalable Coherency Fabric, 96 lanes of PCIe Gen 6, up to 1.2 TB/s of LPDDR5X memory bandwidth, and confidential computing support. NVIDIA claims up to 3x the core-to-core bandwidth and up to 50% lower core-to-core latency than x86 alternatives, up to 40% lower loaded memory latency than chiplet-based designs, and 2x the performance per watt of x86 CPUs.[2]

The blog also reports tests by [CoreWeave](https://aiwiki.ai/wiki/coreweave). CoreWeave found sandbox startup more than 3x faster on Vera than on x86, with a single rack supporting more than 11,000 concurrent agent environments, and found Vera 1.8x faster on [Terminal Bench](https://aiwiki.ai/wiki/terminal_bench), which NVIDIA describes as measuring "CPU performance across real agentic loop tasks."[2] A chart caption gives the comparison as against "a leading x86 CPU across 20 real-world agent tasks"; the x86 part is not named.[2] Vera is not required: NVIDIA's OpenShell FAQ says OpenShell "runs across CPU systems", and the reference design calls Vera "the platform's agent-compute option, not a mandatory Secure Agent Workspace CPU."[8][12]

### BlueField-4 and NVIDIA Sentry

NVIDIA now calls Sentry "a security software framework" (in September it was "an out-of-band watchdog" in a "reference system design").[3][15] It is built on DOCA and runs on BlueField-4. In the reference architecture, NVIDIA says, "agents execute on NVIDIA Vera CPUs, while BlueField-4 sits on the node's only path to the model", so Sentry can inspect agent-to-model traffic "without relying on the agent to report its own behavior."[3] NVIDIA's deep dive on Sentry, by Ofir Arkin, Ariel Kit and Itay Ozery, describes its parts:[3]

| Component | Function described by NVIDIA |
|---|---|
| DOCA Flow | A layer-4 firewall for each agent, accelerated in silicon, that blocks unauthorized destinations and forwards permitted traffic for inspection |
| DOCA Tower | Sentry's "AI security gateway", built on the Envoy proxy; a transparent proxy that terminates TLS with in-silicon acceleration and inspects requests and responses at layer 7 |
| Open Policy Agent | Evaluates access requests against Rego policies; NVIDIA says it can do so "in under a millisecond, depending on policy complexity and configuration" |
| DOCA Argus | Agentless live introspection of selected host memory from the DPU, mapping containers, microVMs, processes, libraries and network connections, and tracking containers, processes and libraries by hash |
| Classifier models | Specialized AI models, run locally or remotely on GPU systems, that classify agent communications and reasoning traces inline or out of band to detect drift |

Because Sentry joins network data from DOCA Tower with runtime context from DOCA Argus, a policy can require, for example, that a container's hash be on an approved list and that the process opening a connection appear in the container's software bill of materials.[3] Warning signs listed by NVIDIA include running unapproved tools, using ptrace against another process, heavy outbound traffic suggesting data leakage, unauthorized file changes, CPU spikes and large-scale file deletion.[3] Inspection covers agent-to-agent and [Model Context Protocol](https://aiwiki.ai/wiki/model_context_protocol) traffic and can redact personal data and secrets. DOCA Tower integrates with SPIFFE/SPIRE for workload identity, and Sentry keeps attested, tamper-evident records on the DPU that it can export to XDR and SIEM platforms.[3] When it detects a deviation, Sentry "can request millisecond-scale in-silicon containment", and NVIDIA says Sentry retains its monitoring and enforcement capabilities even if an agent escapes its sandbox.[3]

On its Sentry product page NVIDIA attributes the added agent capacity to offload: BlueField-4 provides "dedicated infrastructure processing" for Sentry, which NVIDIA says preserves host compute and reduces "the CPU tax to increase agent capacity."[1][13] NVIDIA treats the DPU tier as optional. The technical blog calls BlueField-4 and Sentry "an optional hardware safeguard alongside OpenShell's software boundaries", and the reference design says "OpenShell can be deployed independently of BlueField-4."[2][8] NVIDIA also plans to publish core Envoy plugins, including one that exposes agent communications for analysis of reasoning traces.[3]

## Secure Agent Workspace Reference Design

The deployment guide linked from the release's availability line is titled "Building secure agent workspaces with NVIDIA OpenShell Reference Architecture" and covers what NVIDIA calls the Secure Agent Workspace, described as "a Capability Reference Design within the Enterprise AI Factory."[4] It targets always-on agents that "operate for hours at a time on behalf of an individual employee." The user's browser, terminal or IDE is only a presentation layer; the agent runs in a managed remote environment (a single-user VM or a policy-approved sandbox, optionally with a GPU) reached through a trusted access broker.[4] The threats it lists are unauthorized or accidental writes, data exfiltration, [prompt injection](https://aiwiki.ai/wiki/prompt_injection), an agent attacking other systems, and compromise of the workspace's guest operating system.[4]

### Maturity model and invariants

The guide defines a baseline of standard managed-workstation controls (Phase 0) and two additive phases. Phase I adds controls at the workspace perimeter: single sign-on and an access broker, image governance, a network allowlist, human review for writes, and audit logging. Phase II adds operating-system-level process, filesystem and network controls around the agent runtime, including deny-by-default egress and signed policy enforced at tool calls; OpenShell is the named example of this runtime layer.[4][10] The architecture is split into seven logical planes (user endpoint, control plane, bootstrap plane, access management, agent workspace, safe runtime and enterprise services), and NVIDIA lists the invariants it is meant to preserve:[5]

- raw provider credentials stay outside the agent process;
- no self-granted authority, so widening scope requires a re-issued, signed delegation;
- no connection to an unlisted destination, enforced at both the network boundary and the runtime;
- no tampering with system binaries;
- no agent-created persistence, such as writes to shell startup files, hooks or MCP-server configuration;
- no agent-controlled lifecycle;
- no suppressed audit, with OCSF-normalized events emitted from enforcement points outside the agent.

The guide recommends VM-backed isolation, such as a managed VM or a Kata Containers sandbox, for untrusted or model-generated code, and says a raw pod or ordinary container without an approved sandbox runtime "does not satisfy Secure Agent Workspace."[7] It frames workspace profiles around the "lethal trifecta" (access to private data, exposure to untrusted content, and the ability to communicate externally): a corporate profile accepts all three but bounds external access with an allowlist, brokered network paths, a credential proxy and human review on writes, while a public profile keeps private data out.[6] It also states what the design is not, including a multi-user workspace, an identity provider, or a substitute for code review, and it leaves out the pattern in which the agent runs outside the sandbox.[7]

### Deployment tiers

| Tier | Typical shape | Notes in the guide |
|---|---|---|
| CPU VM | Managed VM | Starter proof of concept; "sufficient for most agentic coding" on routed inference |
| GPU VM or workstation | Managed VM or workstation with GPU | GPU-accelerated tools and small local models; inference routed by default |
| Deskside accelerated workstation | DGX Spark, DGX Station, RTX PRO workstation | Local inference of models that fit the device; data that cannot leave the host |
| Team shared system | Shared DGX, HGX or RTX PRO Server | Separate per-user VMs or microVMs on shared hardware, not a shared workspace |
| Platform fleet | Managed fleet with policy distribution, telemetry and SIEM | Requires signed releases, rollback and an incident process |

Source: Secure Agent Workspace Reference Design, "Deployment Tiers."[8]

The guide treats inference as "a hard dependency, not a workspace feature": a model runs either locally, outside the agent's sandbox, or behind a routed endpoint reached through the credential mediator.[5] It adds an optional confidential-computing serving profile in which an encrypted proprietary model is served from an NVIDIA Confidential Container combining a Kata confidential VM, a CPU trusted execution environment and a GPU in Confidential Computing mode, decrypted only after attestation; the guide notes this "does not make the agent workspace itself confidential."[9] Two reference implementations are documented. One runs on Red Hat OpenShift Virtualization, with one persistent VM per user and GitOps-managed policy.[10] The other is a "proposed" Microsoft Azure profile using ephemeral single-user Azure Linux VMs behind Azure Firewall Premium, where the initial version provides Phase I and Phase II "requires a separately qualified runtime integration."[11]

On NVIDIA's own performance claims for Sentry, the guide says: "NVIDIA describes attested telemetry and millisecond quarantine. Treat these as published capabilities of NVIDIA Sentry", and tells deployers to establish covered traffic paths, failure behavior and measured containment times for their own deployment.[8]

## Partners

NVIDIA's release groups the organizations it names by role. Its summary lists Anthropic, AWS, Cisco, CrowdStrike, Dassault Systèmes, Dell Technologies, Google Cloud, HPE, IBM, Meta, Microsoft, OpenAI, Palo Alto Networks, Perplexity, SAP, ServiceNow, Siemens and SpaceX Super Intelligence among those "working with the OpenShell Reference Architecture to enhance the security of agent deployments."[1] None of OpenAI, Google, Meta or AWS was named in the 28 September Open Agent Safety Platform release.[15]

| Group (NVIDIA's wording) | Organizations named |
|---|---|
| Model builders whose agents can run on OpenShell infrastructure | [Anthropic](https://aiwiki.ai/wiki/anthropic), [Cohere](https://aiwiki.ai/wiki/cohere), Google, Meta, OpenAI, [Perplexity](https://aiwiki.ai/wiki/perplexity), [Reflection](https://aiwiki.ai/wiki/reflection_ai), SpaceX Super Intelligence |
| Cybersecurity vendors integrating support | 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, [Microsoft](https://aiwiki.ai/wiki/microsoft), Okta, Palo Alto Networks, TrendAI, Zscaler |
| Banks exploring the architecture | BBVA, Santander |
| Enterprise software companies building agent platforms with OpenShell | Cadence, Dassault Systèmes, IBM, SAP, [Siemens](https://aiwiki.ai/wiki/siemens), Synopsys; [Palantir](https://aiwiki.ai/wiki/palantir) deploying secure agents with customers |
| System manufacturers | Dell Technologies, Cisco, HPE, [Lenovo](https://aiwiki.ai/wiki/lenovo), Supermicro |
| Cloud service providers deploying "OpenShell-ready infrastructure" | CoreWeave, [Crusoe](https://aiwiki.ai/wiki/crusoe), Firebird, Firmus, GMI Cloud, [IREN](https://aiwiki.ai/wiki/iren), [Lambda](https://aiwiki.ai/wiki/lambda), [Nebius](https://aiwiki.ai/wiki/nebius), [Nscale](https://aiwiki.ai/wiki/nscale), [Oracle Cloud Infrastructure](https://aiwiki.ai/wiki/oracle_cloud_infrastructure), Vultr |
| Inference and post-training providers | [Baseten](https://aiwiki.ai/wiki/baseten), [Deepinfra](https://aiwiki.ai/wiki/deepinfra), [Fireworks](https://aiwiki.ai/wiki/fireworks_ai), [Together AI](https://aiwiki.ai/wiki/together_ai) |

Source: NVIDIA press release, 21 October 2026.[1]

NVIDIA also said it is "working with model builder partners on OpenShell deployments for advanced model research", without naming them.[1]

### Partner announcements

Several partners published their own material on 21 October 2026.

- **[ServiceNow](https://aiwiki.ai/wiki/servicenow)** made Arc, a personal long-running agent, generally available. IT teams define Arc's policies in ServiceNow's Super Intelligence Control Tower and OpenShell enforces them at runtime. ServiceNow said its AI Passport, an attested record for each governed agent, will be read by OpenShell and by Sentry on BlueField so that a revocation can propagate across both layers "within approximately one second." AI Passport enforcement in OpenShell and BlueField "is expected to be available in a future release."[19] NVIDIA's release describes the same revocation as taking effect "within seconds."[1]
- **CrowdStrike** said it is integrating Falcon Guardian, its AI detection and response product, with OpenShell, and "plans to integrate with NVIDIA Sentry."[20] Chief business officer Daniel Bernard said: "AI agents have already created a new attack surface, and guardrails alone won't stop an adversary."[20]
- **Check Point** said OpenShell can send an agent's proposed action to Check Point for review before an important tool call, so that an off-task action can be blocked and the agent redirected rather than shut down. Its AI Factory Firewall uses Sentry and DOCA Argus to watch workloads from outside. Check Point called the combined approach "the direction we are building toward".[21]
- **F5** described two reference architectures built on the design. In the first, its AI Guardrails run under one policy both on Vera inside the OpenShell path and on BlueField-4 within NVIDIA Sentry; the second, which F5 called proposed and subject to product validation, adds BIG-IP Next for Kubernetes on BlueField-4 or the host CPU with Guardrails inside it. In both, F5's control plane and AI Red Team run alongside the models on Vera Rubin NVL72. F5 noted that Guardrails "require only an Arm CPU."[22]
- **Cisco** said Sentry's host-independent monitoring could complement Cisco AI Defense, and referred to Sentry's "planned L7 inline proxy."[23] A separate Cisco post described DefenseClaw, its security layer for agents, which maps a user's directory group to a policy profile that shapes the OpenShell sandbox and its egress rules.[24]
- **SAP** said it contributes to OpenShell's code and has embedded OpenShell in SAP Business AI Platform, where agents built in Joule Studio are deployed.[25]
- **Dell Technologies** said its security architecture for the Dell AI Factory with NVIDIA combines its hardware with the reference architecture "for runtime governance" and Red Hat AI Factory software. It announced the PowerEdge M9882, which puts 256 Vera CPUs in one 48U rack for agent execution, with availability planned for the first calendar quarter of 2027.[26]
- **BBVA** announced plans to work with NVIDIA "to explore the potential" of the architecture for agent safety, security and governance.[27]
- **Dassault Systèmes** said it uses OpenShell to govern long-running autonomous agents.[28]

NVIDIA's Justin Boitano, vice president of enterprise, was quoted in the CrowdStrike release: "The NVIDIA OpenShell Reference Architecture provides the foundation for runtime security and hardware-based enforcement."[20]

## Announcement and quotes

NVIDIA's newsroom posted on X that the architecture is meant "to help businesses run AI agents under control", calling it an "open design" that "combines accelerated compute for agents with hardware-isolated security for deployment at scale."[16] NVIDIA's main account posted a clip with the caption "Jensen introduces the OpenShell Reference Architecture to help businesses set boundaries for AI agents and stop them when they step outside those boundaries."[17]

Huang's statement in the release began: "AI capability and safety must advance together. As enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture."[1] He said NVIDIA "created OpenShell to give agents the freedom to do useful work within clearly defined boundaries", with agents "contained, monitored and under control."[1]

## Availability

As of 25 October 2026:

| Component | Status | Source |
|---|---|---|
| Reference architecture | "Now available" per NVIDIA; the phrase links to the Secure Agent Workspace Reference Design documentation, last updated 21 October 2026 | [1][4] |
| NVIDIA OpenShell | Open source, on GitHub and NVIDIA's website | [12][27] |
| NVIDIA Sentry | "Planned availability early next year"; DOCA Argus, DOCA Flow and OVS-DOCA available now for experimentation | [3] |
| ServiceNow AI Passport enforcement in OpenShell and BlueField | "Expected to be available in a future release" | [19] |
| CrowdStrike integration with Sentry | Planned | [20] |

The release carries NVIDIA's standard notice that many described products "remain in various stages and will be offered on a when-and-if-available basis."[1]

## Relationship to the Open Agent Safety Platform

NVIDIA uses both names. The 21 October release does not mention the platform.[1] NVIDIA's Sentry product page says Sentry "is part of the NVIDIA Open Agent Safety Platform built on the NVIDIA OpenShell Reference Architecture for Safe AI Agents", and NVIDIA's agent-safety page, still titled for the platform, now promotes the reference architecture.[13][31] Cisco's DefenseClaw post describes OpenShell as "also part of NVIDIA's broader Open Agent Safety Platform."[24] Compared with the September announcement, which named the software runtime and the DPU watchdog, the October architecture places them in a specified hardware stack with an inference tier and edge systems, and adds deployment guidance.[1][2][15]

## Reception

Yahoo Finance's Daniel Howley explained that a reference architecture "is a basic design for a server or other platform that customers and partners can customize for their own needs", and described the BlueField-4 DPUs as "acting as security guards that block agents if they attempt unauthorized actions."[29] Decrypt's Jose Antonio Lanz reported the mismatch in timing: "The company says the architecture is available now, but the Sentry deep dive lists the framework's planned availability as early next year."[30]

NVIDIA's reference design itself qualifies several launch claims and tells deployers to measure rather than assume: naming a runtime "is not evidence" of approved isolation, "DPU presence alone does not establish Phase II", and quarantine and containment times must be measured for each workload and topology.[7][8][32] The performance and capacity figures in the launch materials (30x throughput per megawatt, 2x versus x86, up to 20% more agent capacity, millisecond quarantine) are NVIDIA's claims, and the CoreWeave results are a partner's tests reported by NVIDIA. The release does not describe how the 2x and 20% figures were measured.[1][2][3]

## See also

- [NVIDIA OpenShell](https://aiwiki.ai/wiki/nvidia_openshell)
- [NVIDIA Open Agent Safety Platform](https://aiwiki.ai/wiki/nvidia_open_agent_safety_platform)
- [NVIDIA BlueField](https://aiwiki.ai/wiki/bluefield)
- [NVIDIA DOCA](https://aiwiki.ai/wiki/nvidia_doca)
- [NVIDIA Vera (CPU)](https://aiwiki.ai/wiki/nvidia_vera_cpu)
- [NVIDIA NemoClaw](https://aiwiki.ai/wiki/nvidia_nemoclaw)
- [NVIDIA Agent Toolkit](https://aiwiki.ai/wiki/nvidia_agent_toolkit)
- [AI agent sandbox escapes](https://aiwiki.ai/wiki/ai_agent_sandbox_escapes)
- [Agentic AI](https://aiwiki.ai/wiki/agentic_ai)
- [AI safety](https://aiwiki.ai/wiki/ai_safety)

## References

1. NVIDIA. "NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents." NVIDIA Newsroom, 21 October 2026. https://nvidianews.nvidia.com/news/openshell-reference-architecture
2. Hannah Coutand, Itay Ozery, Alex Sandu and Kirit Thadaka. "How NVIDIA OpenShell Reference Architecture Secures and Governs AI Agent Workloads at Scale." NVIDIA Technical Blog, 21 October 2026. https://developer.nvidia.com/blog/how-nvidia-openshell-reference-architecture-secures-and-governs-ai-agent-workloads-at-scale/
3. Ofir Arkin, Ariel Kit and Itay Ozery. "Inside NVIDIA Sentry: Secure AI Agents at Runtime." NVIDIA Technical Blog, 21 October 2026. https://developer.nvidia.com/blog/inside-nvidia-sentry-secure-ai-agents-at-runtime/
4. NVIDIA. "Always-on, Autonomous Agents, Now Safe for the AI Factory." Building secure agent workspaces with NVIDIA OpenShell Reference Architecture (Secure Agent Workspace Reference Design), NVIDIA documentation, last updated 21 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/abstract.html
5. NVIDIA. "Reference Architecture." Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 25 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/reference-architecture.html
6. NVIDIA. "Where Secure Agent Workspace Fits." Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 25 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/where-it-fits.html
7. NVIDIA. "What Secure Agent Workspace Is Not." Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 25 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/what-it-is-not.html
8. NVIDIA. "Deployment Tiers" (including "NVIDIA Sentry Integration Profile"). Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 25 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/deployment-tiers.html
9. NVIDIA. "Confidential Computing as an Additive Inference Serving Profile." Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 25 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/confidential-computing-inference-profile.html
10. NVIDIA. "Red Hat OpenShift Reference Implementation." Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 25 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/openshift-virtualization-reference-implementation.html
11. NVIDIA. "Microsoft Azure Reference Implementation." Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 25 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/azure-reference-implementation.html
12. NVIDIA. "NVIDIA OpenShell: Open, Secure Runtime for AI Agents" (product page and FAQ). Accessed 25 October 2026. https://www.nvidia.com/en-us/ai/openshell/
13. NVIDIA. "NVIDIA Sentry" (product page and FAQ). Accessed 25 October 2026. https://www.nvidia.com/en-us/networking/products/software/sentry/
14. Shruti Koparkar. "Productive, Durable, Fungible: How NVIDIA AI Factories Maximize Return on Investment." NVIDIA Blog, 1 October 2026. https://blogs.nvidia.com/blog/productive-durable-fungible-ai-factories/
15. NVIDIA. "NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment." NVIDIA Newsroom, 28 September 2026. https://nvidianews.nvidia.com/news/open-agent-safety-platform
16. NVIDIA Newsroom (@nvidianewsroom). Post on X announcing the OpenShell Reference Architecture, 21 October 2026. https://x.com/nvidianewsroom/status/2112846545905230041
17. NVIDIA (@nvidia). "Jensen introduces the OpenShell Reference Architecture..." Post on X, 21 October 2026. https://x.com/nvidia/status/2112847277282721888
18. Arm (@Arm). Post on X about the OpenShell Reference Architecture, 21 October 2026. https://x.com/Arm/status/2112924967088308692
19. ServiceNow. "ServiceNow delivers industry-first personal enterprise agent and policy enforcement with NVIDIA, extending AI governance across software and silicon." ServiceNow Newsroom (Business Wire), 21 October 2026. https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-delivers-industry-first-personal-enterprise-agent-and-policy-enforcement-with-NVIDIA-extending-AI-governance-across-software-and-silicon/
20. CrowdStrike. "CrowdStrike and NVIDIA Expand AI Agent Security from Software to Silicon." Press release, 21 October 2026. https://www.crowdstrike.com/en-us/press-releases/crowdstrike-nvidia-expand-ai-agent-security-software-silicon/
21. Check Point Team. "Keeping AI Agents on Task: Check Point Advances AI Agent Safety with NVIDIA OpenShell Reference Architecture." Check Point Blog, 21 October 2026. https://blog.checkpoint.com/ai-security/keeping-ai-agents-on-task-check-point-advances-ai-agent-safety-with-nvidia-openshell-reference-architecture/
22. Kunal Anand. "Delivering and securing AI agents in AI factories: F5 for the NVIDIA OpenShell Reference Architecture for safe AI agents." F5 Blog, 21 October 2026. https://www.f5.com/company/blog/delivering-and-securing-ai-agents-running-within-ai-factories-with-f5-and-nvidia
23. Will Eatherton and Jeremy Foster. "Securing AI Agents Across the AI Factory." Cisco Blogs, 21 October 2026. https://blogs.cisco.com/news/securing-ai-agents-across-the-ai-factory
24. Vineeth Sai Narajala and Ruchika Pandey. "Protect enterprise coding agents with Cisco DefenseClaw and NVIDIA OpenShell." Cisco Blogs, 21 October 2026. https://blogs.cisco.com/ai/protect-enterprise-coding-agents-with-cisco-defenseclaw-and-nvidia-openshell
25. Andre Lamego. "SAP Advances Safe and Reliable Enterprise AI with NVIDIA." SAP Community, October 2026. https://community.sap.com/t5/technology-blog-posts-by-sap/sap-advances-safe-and-reliable-enterprise-ai-with-nvidia/ba-p/14504327
26. Dell Technologies. "Dell Technologies Advances Enterprise Agentic AI from the Deskside to Data Center with NVIDIA." Press release, 21 October 2026. https://www.dell.com/en-us/dt/corporate/newsroom/announcements/detailpage.press-releases~usa~2026~10~dell-technologies-and-nvidia-advance-enterprise-agentic-ai-from-the-deskside-to-data-center.htm
27. BBVA. "BBVA explores new approaches to AI agent security with NVIDIA." BBVA, 21 October 2026. https://www.bbva.com/en/innovation/bbva-explores-new-approaches-to-ai-agent-security-with-nvidia/
28. Nicolas Cerisier and Hubert Masson. "Dassault Systèmes' Long-Running Agents." Dassault Systèmes blog, 21 October 2026. https://blog.3ds.com/topics/company-news/long-running-agents
29. Daniel Howley. "Nvidia debuts platform for keeping AI agents from going rogue and humanoid robot design at GTC Berlin." Yahoo Finance, 21 October 2026. https://finance.yahoo.com/technology/article/nvidia-debuts-platform-for-keeping-ai-agents-from-going-rogue-and-humanoid-robot-design-at-gtc-berlin-113000342.html
30. Jose Antonio Lanz. "Nvidia Unveils Its Full-Stack Blueprint to Contain and Monitor AI Agents." Decrypt, 21 October 2026. https://decrypt.co/381570/nvidia-ai-agent-containment-tools-full-stack-blueprint
31. NVIDIA. "NVIDIA Open Agent Safety Platform: Secure AI Agents" (solutions page). Accessed 25 October 2026. https://www.nvidia.com/en-us/solutions/ai/agent-safety/
32. NVIDIA. "Security And Governance Model." Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 25 October 2026. https://docs.nvidia.com/enterprise-reference-architectures/secure-agent-workspace-reference-design/latest/security-and-governance-model.html