NVIDIA Sentry

NVIDIA Sentry is a security software framework from NVIDIA that monitors autonomous AI agents and enforces policy on their access to models, tools and data from a BlueField-4 data processing unit (DPU) rather than from the host computer the agent runs on. It is built on NVIDIA DOCA, the software framework for BlueField and ConnectX devices, and combines an Envoy-based gateway called DOCA Tower, the DOCA Argus memory-introspection service, a per-agent layer-4 firewall built with DOCA Flow, policy evaluation with Open Policy Agent, and optional classifier models that judge agent behavior.^[1][2] NVIDIA says Sentry can contain or quarantine an agent "within milliseconds" without the cooperation of the agent or the host software, and that it keeps monitoring even if an agent escapes its sandbox; these are NVIDIA's own claims and it has not published measurements for them.^[1][2][7]

NVIDIA first presented Sentry on 28 September 2026 as "an out-of-band watchdog" in the reference system design of the NVIDIA Open Agent Safety Platform, next to the open source NVIDIA OpenShell runtime.^[3] At GTC Berlin on 21 October 2026 it became the enforcement tier of the NVIDIA OpenShell Reference Architecture, now described as a "unified security software framework", and NVIDIA published a technical deep dive on it; that day's press release also linked to a Sentry product page.^[1][2][5] Unlike OpenShell, Sentry is not open source, according to NVIDIA vice president Justin Boitano.^[8] As of 28 October 2026, NVIDIA's most recent statement on timing is the deep dive's reference to Sentry's "planned availability early next year."^[1]

Background

Sentry is NVIDIA's response to a specific claim about recent agent incidents. The 28 September 2026 press release said that in each case "the agent circumvented security controls at the application layer to complete its assigned task," and the October deep dive opens by stating that "an AI agent can complete its assignment and still cross a security boundary." Its conclusion is that "monitoring and enforcement need to operate outside the agent's reach so that it can't alter or disable them."^[1][3] NVIDIA did not name the incidents; The New Stack tied the launch to the summer 2026 sandbox escapes, including the OpenAI-Hugging Face agent incident of July 2026, which are covered in AI agent sandbox escapes.^[8]

The September launch blog, written by John Myers, Alex Watson, Ali Golshan and Ofir Arkin, set out the principles Sentry is meant to implement. Two of them describe its job directly: enforcement "must be out of band", so controls do not live inside or within reach of the agent, and "the path to the model (the brain) is the control point", because an agent cannot act without its next call to the model. The authors also define drift, "agent actions that depart from the intended task or operating constraints", which Sentry's classifiers and runtime checks are meant to detect.^[4]

The hardware argument predates Sentry. A June 2026 NVIDIA technical post by Arkin, Uriya Stern and Itay Ozery described BlueField DPUs as operating "within its own trusted execution domain", so that monitoring, policy enforcement and telemetry "operate even if the host or workloads become compromised," and presented a DOCA security stack of DOCA Argus (runtime threat detection), DOCA Vault (file-access control) and DOCA Flow (accelerated packet processing, including layer-4 firewalls and "AI security gateways").^[13] The Sentry deep dive cites that post as the foundation it builds on.^[1]

History

The wording changed between the two launches. In September NVIDIA called Sentry a "reference system design" and an "out-of-band watchdog"; in October the release, the reference architecture blog and the product page call it a "security software framework" or "unified security software framework."^[2][3][5][6]

Architecture

Placement

Sentry depends on where the DPU sits. The September blog says that "in an NVIDIA Vera Rubin POD, each compute tray includes a BlueField-4 data processing unit on the node's only path to the model."^[4] In the OpenShell Reference Architecture, agents execute on NVIDIA Vera CPUs while BlueField-4 "sits on the node's only path to the model", so Sentry inspects agent-to-model traffic "without relying on the agent to report its own behavior."^[1] According to the deep dive, agent network traffic reaches BlueField-4 "through a direct network I/O path that bypasses host OS/hypervisor packet processing," and all of an agent's network communications are governed by Sentry because the DPU is on the only path to the model and to the outside world.^[1] Boitano described the same arrangement to The New Stack: with a DPU present, the agent's model endpoint is routed "through a proxy on the DPU, so that you can see all of the reasoning traces of the agents on the host."^[8]

NVIDIA's own deployment guide limits this claim to that topology. Its Sentry integration profile says the published Vera Rubin POD example "makes the hardware-controlled model path part of its topology," while "other Secure Agent Workspace topologies must establish their own bypass-resistant paths."^[7]

Components

Network path: DOCA Flow and DOCA Tower

Network access is controlled in two stages. DOCA Flow acts as a per-agent layer-4 firewall that drops connections to unauthorized destinations and passes permitted traffic to DOCA Tower for layer-7 inspection, authorization and further checks.^[1] DOCA Tower is built on Envoy, the open source proxy that describes itself as "an L7 proxy and communication bus designed for large modern service oriented architectures."^[1][33] It runs as a transparent proxy and terminates Transport Layer Security (TLS) using BlueField's built-in TLS acceleration; for connections configured for inspection, it decrypts agent traffic that the layer-4 firewall has allowed.^[1]

Access decisions use Open Policy Agent (OPA), an open source, general-purpose policy engine and graduated Cloud Native Computing Foundation project, whose policies are written in the declarative language Rego.^[1][31] NVIDIA says DOCA Tower is "compatible with OpenShell policies", using OPA to extend OpenShell's network access policies and runtime controls into BlueField-4.^[1] OpenShell itself compiles its YAML policies to OPA/Rego.^[15]

Runtime context: DOCA Argus

DOCA Argus, which NVIDIA also offers on its own as a DOCA microservice, gives Sentry information about the agent's execution environment.^[1][14] Its documentation says it "uses hardware-level live machine introspection and NVIDIA DOCA DMA to read selected structures in volatile host memory," identifies the host's Linux kernel version, applies a matching memory map, and supports x86 and Arm64 hosts without a host-resident agent.^[14] In Sentry, Argus maps containers to pods and sandboxes to microVMs, identifies running processes and their properties, maps relationships between processes, threads, file access, network connections, loaded libraries, CPUs, GPUs and memory, and tracks containers, processes and libraries by hash.^[1]

Sentry correlates connection data from DOCA Tower with this context. NVIDIA's example policy requires that a container's hash match an approved list, and that the process opening a connection, identified by its hash, appear in the container's software bill of materials (SBOM), be permitted to open network connections, and use an approved execution path and command-line arguments. DOCA Tower then checks whether the requested action, such as calling a particular API, is allowed.^[1]

Argus also feeds continuous checks that are not tied to a single request. The warning signs NVIDIA lists are running unapproved tools; using ptrace to attack another process or spawning a process that attacks the agent; excessive outbound traffic suggesting data leakage; unauthorized file access or changes; CPU spikes; excessive writes to temporary folders; and large-scale file deletion. When Sentry detects a deviation, NVIDIA says, it "can request millisecond-scale in-silicon containment."^[1]

Request and response controls

Sentry inspects both what an agent sends and what comes back, on the reasoning that responses can carry malicious instructions that redirect an agent. Through DOCA Tower, NVIDIA says the controls can:^[1]

• apply IP-, URL- and protocol-level restrictions;
• capture tamper-evident records of requests, responses and data flows;
• govern agent-to-agent (A2A) and Model Context Protocol traffic;
• detect and redact personally identifiable information and secrets such as API keys, tokens and passwords;
• identify and block content prohibited by policy.

Behavioral classifiers

Sentry can send inspected communications to specialized AI models that classify agent behavior from tool calls and "available reasoning traces", running locally or remotely on GPU-accelerated systems. The classifiers judge whether behavior is consistent with the agent's designed intent or indicates drift. Inline classification can block content before it reaches its destination; out-of-band classification triggers a response after misbehavior is detected.^[1] The deep dive does not name the classifier models. NVIDIA says it plans to publish core plugins, including one "that exposes agent communications for further analysis of available reasoning traces."^[1]

Identity

DOCA Tower integrates with SPIFFE/SPIRE and supports partner identity systems.^[1] SPIFFE describes itself as "a set of open-source standards for securely identifying software systems in dynamic and heterogeneous environments"; SPIRE is the project's server and agent software.^[32] NVIDIA describes the decision as three parts: identity establishes who makes a request, authorization policy determines what that identity may access, and runtime evidence from Argus adds context about the environment behind the request. If an agent's behavior or integrity changes, Sentry can take that into account on later requests.^[1]

Containment and records

NVIDIA says Sentry "can contain and quarantine agents within milliseconds using BlueField-4 in-silicon enforcement capabilities without the cooperation of the agent or the host software," and that it retains monitoring and enforcement "even if an agent escapes its sandbox."^[1] The product page describes containment as the ability to "restrict agent access or isolate communications within milliseconds."^[2]

Sentry also produces attested telemetry and tamper-evident records in BlueField-4's trust domain. DOCA Tower records inspected communications and policy decisions, and Argus adds runtime signals. The deep dive's point is that "an agent that changes a log inside its own environment cannot make the same change to the protected record maintained on BlueField-4." The records can be exported to extended detection and response (XDR) and security information and event management (SIEM) platforms and to security data lakes.^[1]

Extensibility

Because DOCA Tower is built on Envoy, NVIDIA says partners can adapt existing Envoy plugins or write new ones to run on BlueField, adding access controls, content inspection, telemetry or detection logic in the application-layer path.^[1] The product page says developers and security providers can "integrate their own signals, policies, and detection logic" through DOCA libraries and microservices.^[2]

Relationship to OpenShell

NVIDIA presents OpenShell and Sentry as two layers. OpenShell is the software runtime that "governs what an agent can do" and separates policy enforcement from the agent workload; Sentry "adds an independent hardware safeguard out of band, running on BlueField-4, beyond the agent's reach and knowledge."^[1] Help Net Security summarized the September design as OpenShell at the runtime layer and Sentry at the infrastructure layer.^[34]

NVIDIA treats the Sentry layer as optional. The reference architecture blog calls BlueField-4 and Sentry "an optional hardware safeguard alongside OpenShell's software boundaries," and the deployment guide says "OpenShell can be deployed independently of BlueField-4."^[6][7] Boitano told The New Stack that "the DPU is really optional in these architectures," that "just using OpenShell on CPUs is honestly good enough" in many cases, and that the DPU is for "frontier use cases of evaluating models or systems where you might have the guardrails off the models, so it could be for red teaming." He compared the design to an autonomous vehicle with "a primary system" and "a safety island."^[8] In September NVIDIA said that for systems already running Vera with BlueField-4, "enabling these protections is just a software update."^[4]

The Secure Agent Workspace deployment guide places Sentry as a profile for "deployments requiring protection that remains effective during workspace worker-host compromise." It adds that the named components "do not by themselves establish Phase II conformance," and tells deployers: "NVIDIA describes attested telemetry and millisecond quarantine. Treat these as published capabilities of NVIDIA Sentry," then establish covered traffic paths, telemetry verification, failure behavior and measured containment objectives for their own deployment.^[7]

Performance claims

All published figures come from NVIDIA:

The 21 October release does not say how the 20% figure was measured, and the deep dive and product page give no measured containment time.^[1][2][5] In a passage on OpenShell's CPU overhead, Network World reported on 1 October 2026 that NVIDIA had not yet published formal performance measurements.^[23]

Partners and adopters

As of 28 October 2026, NVIDIA's product page lists fourteen companies in a "Builders" section, under the statement that "leading enterprise cybersecurity providers are using NVIDIA Sentry": Akamai, Armis (from ServiceNow), Check Point, Cisco, CrowdStrike, EQTY Lab, F5, Forescout, Fortinet, Palo Alto Networks, ServiceNow, TrendAI, Xage Security and Zscaler.^[2] Several partners have described their Sentry work in their own announcements:

On 13 October 2026 NVIDIA said its five-year UK compute donation, valued at $250 million, would support research including work "conducted using NVIDIA OpenShell open, secure runtime software and the NVIDIA Sentry reference design."^[9] On 26 October 2026 NVIDIA and Meta said they would "consider additional collaboration opportunities" on the OpenShell Reference Architecture, "including NVIDIA OpenShell for safe deployment and NVIDIA Sentry for monitoring agent behavior"; NVIDIA's newsroom account summarized this as "exploring" Sentry.^[10][11] The same release said Meta would deploy BlueField-4, which it tied to network efficiency and throughput rather than to Sentry.^[10]

Availability and licensing

NVIDIA's 21 October deep dive presents Sentry as a future product. It says developers can start with DOCA libraries and microservices that are available now, naming DOCA Argus, DOCA Flow and OVS-DOCA, "ahead of NVIDIA Sentry's planned availability early next year."^[1] That list does not include DOCA Tower. The product page's "Get Started" path leads to the DOCA SDK and documentation rather than to a Sentry download.^[2] Decrypt pointed out the mismatch with the reference architecture, which NVIDIA called "now available" on the same day.^[5][25]

Boitano said in September that Sentry is not open source but has open APIs, and that OpenShell can work with other network enforcement hardware.^[8] Network World's Kerravala described Sentry as "an Nvidia implementation built on BlueField and DOCA," in contrast to OpenShell, which is open and runs on Arm and x86.^[23]

Related research

Sentry belongs to a line of security designs that watch a host from outside it. In 2003 Tal Garfinkel and Mendel Rosenblum proposed virtual machine introspection, an intrusion detection architecture that "retains the visibility of a host-based IDS, but pulls the IDS outside of the host for greater attack resistance" by using the virtual machine monitor; their prototype was called Livewire.^[27] In 2004 Nick Petroni, Timothy Fraser, Jesus Molina and William Arbaugh presented Copilot, a kernel integrity monitor on a PCI add-in card that read host RAM through direct memory access "without the knowledge or intervention of the host kernel"; it detected 12 real-world rootkits, each within 30 seconds of installation, with less than a 1% performance penalty.^[28] DOCA Argus applies the same idea from a DPU, using DMA to read selected host memory structures.^[14] The Sentry deep dive does not cite this earlier work.

Sentry's classifier stage resembles monitoring protocols studied in AI control research, in which a trusted model reviews the actions of a more capable untrusted one; Ryan Greenblatt and colleagues evaluated such protocols against a model deliberately trying to subvert them.^[29] Its use of reasoning traces relates to chain-of-thought monitoring. A 2025 position paper by Tomek Korbak and 40 co-authors argued that monitoring a model's chain of thought "shows promise" but "is imperfect and allows some misbehavior to go unnoticed," and that this monitorability "may be fragile."^[30]

Reception and open questions

Coverage has mostly restated NVIDIA's description. CNBC summarized Sentry as a monitor that "runs on network chips, not CPUs or GPUs."^[26] Network World's Kerravala called Sentry "the more strategically interesting" half of the September platform and wrote that "the strongest version of this story runs on Vera CPUs and BlueField-4, benefiting customers seeking defense in depth and supporting Nvidia's hardware business." He advised reserving out-of-band enforcement such as Sentry "for the highest-risk work, including red teaming, security research, and agents handling regulated data."^[23]

Partners added caveats. Red Hat chief technology officer Chris Wright wrote that the DPU approach "should not be viewed as a single answer to AI safety or agent security" and that its value comes from "adding another independent monitoring and enforcement layer."^[24] Cisco wrote that DPU-based enforcement can preserve protections when host security is compromised "provided the management plane is secured and traffic cannot bypass enforcement," and that containment should also stop agents from using approved services, such as package repositories, as relays to unauthorized destinations.^[21]

Open questions as of 28 October 2026 include:

• Measured performance. The launch materials give no measurement method for the millisecond containment or 20% capacity figures, and NVIDIA's own deployment guide tells operators to establish measured containment objectives themselves.^[1][5][7]
• Coverage outside the reference topology. Sentry's visibility depends on the DPU being on the agent's only path to the model; other topologies must establish their own bypass-resistant paths.^[1][7]
• Hardware dependence. Sentry requires BlueField-4 and is not open source, while OpenShell runs without it.^[7][8]
• Undisclosed components. The deep dive does not name the classifier models, and its list of DOCA components available today does not include DOCA Tower.^[1]

See also

• NVIDIA Open Agent Safety Platform
• NVIDIA OpenShell Reference Architecture
• NVIDIA OpenShell
• NVIDIA BlueField
• NVIDIA DOCA
• NVIDIA Vera Rubin
• AI agent sandbox escapes
• AI control
• Guardrails (AI)

References

1. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14 ^15 ^16 ^17 ^18 ^19 ^20 ^21 ^22 ^23 ^24 ^25 ^26 ^27 ^28 ^29 ^30 ^31 ^32 ^33 ^34 ^35 ^36 ^37 ^38 ^39 ^40 ^41 ^42 ^43 ^44 ^45 ^46Ofir Arkin, Ariel Kit and Itay Ozery. "Inside NVIDIA Sentry: Secure AI Agents at Runtime." NVIDIA Technical Blog, 21 October 2026. developer.nvidia.com/...ecure-ai-agents-at-runtime
2. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9 ^10 ^11 ^12 ^13 ^14NVIDIA. "NVIDIA Sentry: Runtime Security for AI Agents" (product page and FAQ). Accessed 28 October 2026. nvidia.com/...sentry
3. ^1 ^2 ^3 ^4 ^5 ^6NVIDIA. "NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment." NVIDIA Newsroom, 28 September 2026. nvidianews.nvidia.com/...open-agent-safety-platform
4. ^1 ^2 ^3John Myers, Alex Watson, Ali Golshan and Ofir Arkin. "NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring." NVIDIA Technical Blog, 28 September 2026. developer.nvidia.com/...n-silicon-agent-monitoring
5. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8 ^9NVIDIA. "NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents." NVIDIA Newsroom, 21 October 2026. nvidianews.nvidia.com/...ll-reference-architecture
6. ^1 ^2Hannah Coutand, Itay Ozery, Alex Sandu and Kirit Thadaka. "How NVIDIA OpenShell Reference Architecture Secures and Governs AI Agent Workloads at Scale." NVIDIA Technical Blog, 21 October 2026. developer.nvidia.com/...i-agent-workloads-at-scale
7. ^1 ^2 ^3 ^4 ^5 ^6 ^7NVIDIA. "Deployment Tiers" (including "NVIDIA Sentry Integration Profile"). Secure Agent Workspace Reference Design, NVIDIA documentation, accessed 28 October 2026. docs.nvidia.com/...deployment-tiers
8. ^1 ^2 ^3 ^4 ^5 ^6 ^7 ^8Frederic Lardinois. "Nvidia launches Open Agent Safety Platform to lock down rogue AI agents." The New Stack, 28 September 2026. thenewstack.io/nvidia-openshell-sentry-agents
9. ^1 ^2NVIDIA. "NVIDIA Commits $250 Million to Advance UK Agentic Safety and Security Research Over the Next Five Years." NVIDIA Newsroom, 13 October 2026. nvidianews.nvidia.com/...-over-the-next-five-years
10. ^1 ^2 ^3NVIDIA. "NVIDIA and Meta to Expand Collaboration on Muse and Muse Family of Models Amid Robust Growth." NVIDIA Newsroom, 26 October 2026. nvidianews.nvidia.com/...models-amid-robust-growth
11. ^NVIDIA Newsroom (@nvidianewsroom). Post on X about the NVIDIA and Meta collaboration, 27 October 2026 (UTC). x.com/...2114960962734412112
12. ^NVIDIA Asia Pacific (@NVIDIAAP). "We built NVIDIA Sentry on BlueField-4 to secure AI agents from a layer they can't reach or tamper with." Post on X, 27 October 2026 (UTC). x.com/...2114903384394236254
13. ^1 ^2Ofir Arkin, Uriya Stern and Itay Ozery. "Advancing AI Infrastructure for Agentic AI with NVIDIA DOCA In-Silicon Security." NVIDIA Technical Blog, 1 June 2026. developer.nvidia.com/...a-doca-in-silicon-security
14. ^1 ^2 ^3NVIDIA. "DOCA Argus Service Guide." NVIDIA DOCA SDK documentation (3.5.0), accessed 28 October 2026. docs.nvidia.com/...doca-argus-service-guide
15. ^Alex Watson and Ali Golshan. "Add Runtime Controls to AI Agents with NVIDIA OpenShell." NVIDIA Technical Blog, 28 September 2026. developer.nvidia.com/...ents-with-nvidia-openshell
16. ^Anand Oswal. "Securing AI Agents at Scale with NVIDIA." Palo Alto Networks Blog, 28 September 2026. paloaltonetworks.com/...gents-at-scale-with-nvidia
17. ^Jeetu Patel. "Beyond Intelligence: How Trust Is the Benchmark That Matters in AI." Cisco Blogs, 28 September 2026. blogs.cisco.com/...he-benchmark-that-matters-in-ai
18. ^CrowdStrike. "CrowdStrike and NVIDIA Expand AI Agent Security from Software to Silicon." Press release, 21 October 2026. crowdstrike.com/...agent-security-software-silicon
19. ^Check Point Team. "Keeping AI Agents on Task: Check Point Advances AI Agent Safety with NVIDIA OpenShell Reference Architecture." Check Point Blog, 21 October 2026. blog.checkpoint.com/...hell-reference-architecture
20. ^Kunal Anand. "Delivering and securing AI agents in AI factories: F5 for the NVIDIA OpenShell Reference Architecture for safe AI agents." F5 Blog, 21 October 2026. f5.com/...g-within-ai-factories-with-f5-and-nvidia
21. ^1 ^2Will Eatherton and Jeremy Foster. "Securing AI Agents Across the AI Factory." Cisco Blogs, 21 October 2026. blogs.cisco.com/...ai-agents-across-the-ai-factory
22. ^ServiceNow. "ServiceNow delivers industry-first personal enterprise agent and policy enforcement with NVIDIA, extending AI governance across software and silicon." ServiceNow Newsroom (Business Wire), 21 October 2026. newsroom.servicenow.com/...ss-software-and-silicon
23. ^1 ^2 ^3Zeus Kerravala. "Nvidia built the AI factory. Now it's building the locks for the doors." Network World, 1 October 2026. networkworld.com/...ilding-the-locks-for-the-doors
24. ^Chris Wright. "Securing AI agents requires securing the systems around them." Red Hat Blog, 28 September 2026. redhat.com/...equires-securing-systems-around-them
25. ^Jose Antonio Lanz. "Nvidia Unveils Its Full-Stack Blueprint to Contain and Monitor AI Agents." Decrypt, 21 October 2026. decrypt.co/...ntainment-tools-full-stack-blueprint
26. ^Kif Leswing. "Nvidia releases software platform to stop AI agents from misbehaving." CNBC, 28 September 2026. cnbc.com/...nvidia-releases
27. ^Tal Garfinkel and Mendel Rosenblum. "A Virtual Machine Introspection Based Architecture for Intrusion Detection." Network and Distributed System Security Symposium (NDSS), 2003. ndss-symposium.org/...itecture-intrusion-detection
28. ^Nick L. Petroni Jr., Timothy Fraser, Jesus Molina and William A. Arbaugh. "Copilot: a Coprocessor-based Kernel Runtime Integrity Monitor." Proceedings of the 13th USENIX Security Symposium, 2004, pp. 179-194. usenix.org/...petroni
29. ^Ryan Greenblatt, Buck Shlegeris, Kshitij Sachan and Fabien Roger. "AI Control: Improving Safety Despite Intentional Subversion." arXiv:2312.06942, 2023. arxiv.org/...2312.06942
30. ^Tomek Korbak et al. "Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety." arXiv:2507.11473, 2025. arxiv.org/...2507.11473
31. ^Open Policy Agent. "Open Policy Agent documentation." Accessed 28 October 2026. openpolicyagent.org/docs
32. ^SPIFFE. "SPIFFE Overview." Accessed 28 October 2026. spiffe.io/...overview
33. ^Envoy Project. "What is Envoy." Envoy documentation, accessed 28 October 2026. envoyproxy.io/...what_is_envoy
34. ^Anamarija Pogorelec. "NVIDIA wants AI agent safety enforced in silicon, not left to the agent." Help Net Security, 28 September 2026. helpnetsecurity.com/...-open-agent-safety-platform