Launch: A Full-Stack Design for Safe AI Agents
On October 21, 2026, NVIDIA unveiled the OpenShell Reference Architecture at its GTC event in Berlin — a full-stack design for building, isolating, monitoring and enforcing control over safe artificial intelligence (AI) agents across enterprise infrastructure and edge systems. Official press release
The design unites four layers of NVIDIA's technology stack. The NVIDIA Vera Rubin infrastructure runs enterprise workloads, including models built on Nemotron. NVIDIA Vera processors run agent orchestration (agent harness) systems. The open-source NVIDIA OpenShell software defines what agents can do, while NVIDIA BlueField DPUs deliver continuous monitoring and silicon-level policy enforcement as part of the NVIDIA Sentry security platform.
"As enterprises prepare to deploy billions of AI agents, security and control must be embedded in the computing architecture itself... With OpenShell Reference Architecture, agents think on Rubin, act on Vera and are governed on BlueField," said NVIDIA founder and CEO Jensen Huang.
OpenShell runtime: governance inside the infrastructure itself
NVIDIA's position is clear: an agent cannot govern itself, and security and governance must live in the very infrastructure the agent runs on. OpenShell is an open-source runtime that places security and governance directly into the computing infrastructure. It defines and enforces agent access to systems working with files, internet services and physical devices, and treats agent workloads as untrusted by default during execution: the agent gets only what it needs, only when it needs it.
OpenShell consists of four components. Gateway is the control plane that manages sandbox lifecycles and policies. Supervisor validates outbound requests against policy and mediates access to credentials; it runs fully separate from the sandbox. Sandbox isolates the agent workload and restricts access to the file system and processes. Policy prover formally verifies that policy permissions do not exceed the upper bound set by the organization.
According to a technical analysis on the NVIDIA Developer blog, Supervisor middleware provides an additional enforcement layer for inspecting, blocking or modifying the content the agent sends and receives over the network; Gateway interceptors allow adding deployment-specific governance without modifying the gateway itself.
Vera: the compute layer for agent workloads
OpenShell defines what agents can do; Vera defines how fast they do it. Agents operate through chains of dependent steps — reasoning, tool calls, code execution, data requests — and each step must complete before the next begins. NVIDIA sets five requirements for processor architecture in this mode: many cores and fast single-core execution, high memory bandwidth, massive input/output, hardware-level security, and fitting within modern data-center power limits.
According to NVIDIA's own measurements, the Vera processor has 88 Olympus cores and delivers, versus x86, up to 2x higher speed on key agentic workloads, up to 3x inter-core bandwidth, up to 50% lower inter-core latency, up to 1.2 TB/s of LPDDR5X memory bandwidth, and 2x higher performance per watt than x86 processors.
In tests by AI cloud platform CoreWeave, launching a sandbox on Vera proved more than 3x faster than on x86; in Terminal Bench agentic loop tests, task completion was 1.8x faster, and a single rack supports more than 11,000 concurrently running agent environments.
BlueField and Sentry: silicon-level protection
Where deployments require additional protection, control extends to dedicated silicon. NVIDIA BlueField-4 DPUs provide a hardware-isolated trust domain unreachable by the agent. In the OpenShell architecture, BlueField-4 sits on the input/output path between agents running on Vera and the models they use. NVIDIA Sentry — a DOCA-based security software platform — continuously monitors agent behavior in this independent domain and enforces runtime policy.
Sentry monitors requests and responses, network and file activity, verifies identity and privileges, and analyzes selected regions of host memory, detecting deviations from permitted behavior without relying on the agent's own reporting. When a threat or policy violation is detected, BlueField-4 enforces policy in silicon, and Sentry quarantines the agent within milliseconds.
Ecosystem and compatibility
Among the organizations working with the architecture, NVIDIA named Anthropic, AWS, Cisco, CrowdStrike, Dell Technologies, Google Cloud, HPE, IBM, Meta, Microsoft, OpenAI, Palo Alto Networks, Perplexity, SAP, ServiceNow, Siemens and SpaceX Super Intelligence — all working to improve agent deployment security.
The architecture runs on Canonical, Red Hat, Microsoft Windows and Microsoft Execution Containers, and extends to edge deployments through NVIDIA RTX Spark, DGX Spark and DGX Station systems. The OpenShell code is openly available on GitHub.
Note: last week NVIDIA also released three open-weight Nemotron 3.5 models for agents — archived article.
