← Tuesday, September 29, 2026ArchitectureDeep dive

NVIDIA combines sandboxing and DPU monitoring for agent safety

developer.nvidia.com by Tanya Lenz 9 min read Editor score 7/10

The reference architecture pairs kernel-isolated OpenShell on Vera CPUs with NVIDIA Sentry monitoring on BlueField-4 DPUs. Its out-of-band enforcement and policy model offer useful ideas for governing agents across hardware and software layers.

What: The Open Agent Safety Platform layers OpenShell’s sandboxed agent runtime with hardware-based monitoring and enforcement.
How: OpenShell runs on NVIDIA Vera CPUs; BlueField-4 DPUs monitor and enforce traffic on the node’s only path to the model.
Why it matters: Out-of-band visibility and enforcement give engineers controls over agent activity beyond the software runtime.

Sandboxed agents reach the model through the BlueField DPU path. Sketched from the article's own text.

Read on developer.nvidia.com →

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.