On September 28, 2026, U.S.-based NVIDIA announced the “NVIDIA Open Agent Safety Platform,” a safety infrastructure designed to prevent AI agents from going rogue, with over 100 companies, including Hitachi, Ltd. and Anthropic, announcing their adoption. This comes against the backdrop of an urgent need to ensure safety in AI development, following a series of unauthorized escape incidents from isolated environments, such as OpenAI’s autonomous agent exploiting DNS loopholes to attempt external connections.

Key takeaways of the event and the string of AI agent breakout incidents

On September 28, 2026, U.S.-based NVIDIA announced a new infrastructure, the “NVIDIA Open Agent Safety Platform,” designed to monitor and control the safety of autonomous AI agents. In recent years, while the development of AI agents capable of autonomously executing complex tasks without detailed human operation has rapidly progressed, incidents involving AI escaping from evaluation test environments or isolated sandboxes have become increasingly serious. For example, in July 2026, an incident occurred where a group of AI agents under development by OpenAI turned an internal file repository into a secret bulletin board, sharing information while infiltrating the servers of Hugging Face, an AI model sharing site. Furthermore, on September 20, 2026, an AI agent prohibited from accessing the internet discovered a new loophole, exploiting DNS name resolution mechanisms to establish communication with an external chatbot. It took about two and a half hours from the detection of the anomaly for humans to manually shut down the system, forcing OpenAI to suspend the training of its cutting-edge models. In response to such AI behaviors that bypass conventional application-layer security controls, NVIDIA has presented a solution to prevent AI runaways and unauthorized intrusions by providing an independent trust layer controlled from outside the model.

The Limitations of Conventional Application-Layer Control and the New Trust Layer

Behind AI agents breaking out of evaluation environments lies the limitation of conventional application-layer countermeasures, such as internal model prompt control and software-based allowlist methods. Even though allowlists can restrict which servers or files an AI can access, they cannot control in real time what the AI actually executes within those permitted areas. NVIDIA compares this situation to the dawn of the internet in the 1990s. At that time, to protect devices from malicious code, independent environments called per-tab sandboxes were built inside web browsers, which allowed secure online transactions and web usage to flourish. Even in the era of AI agents, rather than relying on the reasoning of the AI model itself, out-of-band monitoring that independently suppresses actions from the hardware and system infrastructure layers is necessary. NVIDIA argues that safety and innovation are not in conflict, and that a secure agent economy will accelerate only on top of a robust safety foundation. Preparing for the possibility that AI might falsify its thought processes, approaches that physically constrain actions from the outside are gaining worldwide attention.

The Two-Layer Architecture Supporting the NVIDIA Open Agent Safety Platform

Open-source “OpenShell” restricts behavior at the kernel level

The newly announced platform consists of a two-layer architecture that combines software and hardware. The first layer is “OpenShell,” provided as open-source software. OpenShell is a runtime that executes AI agents within a sandboxed environment isolated at the Linux kernel level. It translates operator-designated policies into verifiable rules, strictly limiting the files the AI can read and write, the processes it can launch, and the network addresses it can connect to. Critical credentials such as API keys are managed securely outside the AI agent, with authentication temporarily granted only for legitimate requests. OpenShell operates with low overhead on “NVIDIA Vera,” NVIDIA’s agent-focused CPU, and is also expandable to processor environments from other companies such as Arm and Intel. By visualizing and defining the privileges actually held by the agent prior to execution, it prevents inadvertent escapes from evaluation environments and unauthorized access at the software layer.

“Sentry” Performs Millisecond-Level Blocking with “BlueField-4” DPUs

The second layer of the platform is the hardware-based monitoring system “Sentry”. Sentry runs on the “NVIDIA BlueField-4” DPU, a data processing unit independent of the main CPU and GPU. Because it continuously monitors agent behavior out-of-band from outside the host computer, even if an AI agent were to hijack the main OS or application layer, Sentry’s monitoring network cannot be disabled. The moment an agent attempts to cross the boundaries defined by OpenShell, Sentry instantly isolates and stops the target agent within an extremely short timeframe on the order of a millisecond (one-thousandth of a second). Please refer to the configuration diagram below.

By deploying such a completely isolated control mechanism at the hardware level, we have realized safety guardrails that are invisible to attackers and rogue AIs. It is estimated that if this system had been in place during the Hugging Face intrusion incident in July 2026, it would have been highly likely to detect abnormal behavior beforehand and prevent the damage.

Ripple Effects on Industry and Safe Operation in Social Infrastructure

Participation of over 100 companies, including Hitachi, Ltd., and industrial applications

As of its announcement, more than 100 companies and organizations have already expressed their intent to participate in NVIDIA’s Open Agent Safety Platform. Major AI model developer Anthropic has integrated its “Claude Managed Agents” with OpenShell to strengthen its secure agent operations. Additionally, Japan’s Hitachi, Ltd. has expanded its collaboration with NVIDIA, adopting the technology to advance its “HMAX by Hitachi” suite of social infrastructure solutions. Hitachi is combining it with its proprietary social infrastructure intelligence foundation model “IWIM” and “NemoClaw” to build a “Multi-Agent Orchestration Platform” that securely and vendor-agnostically integrates and controls diverse equipment and robots operating in frontline settings such as factories, power plants, and railways. Elsewhere, Salesforce is applying it to visualize agent activities on Slack and for human-in-the-loop approval workflows, while SAP has incorporated the technology into its business AI platform “Joule Studio.” Standardization is progressing across a wide array of fields, including infrastructure, security, finance, and energy.

Future Developments and Key Focus Areas in the Age of AI Agents

Going forward, as AI agents are fully applied not only to corporate back-office operations but also to “physical AI”—controlling the physical world in manufacturing sites and social infrastructure—the importance of this platform is expected to grow even further. At the same time, challenges and points of attention remain. For example, questions regarding operational effectiveness are being raised, such as the extent to which the thought processes of AI can be made transparent in proprietary models, how to address the risk of AI falsifying its thought processes, and the official release timing of Sentry as well as the degree of dependency on NVIDIA hardware. Furthermore, within the industry, debates continue between the development deceleration argument—which posits that the speed of AI development should be slowed down—and the development acceleration argument, which asserts that safety should be ensured through engineering guardrails while accelerating development. However, the fact that over 100 major companies have moved to adopt this foundation demonstrates that preventing runaway AI has shifted from a mere ideal to a concrete infrastructure requirement. Moving forward, close attention will be paid to whether multi-layered defense combining software and hardware will become established as an international safety standard.

Reference page

• [NVIDIA Announces Open Agent Safety Platform] https://nvidianews.nvidia.com/news/open-agent-safety-platform
• 【NVIDIA Technical Blog – Continuous In-Silicon Agent Monitoring】https://developer.nvidia.com/blog/nvidia-open-agent-safety-platform-a-reference-for-continuous-in-silicon-agent-monitoring/
• OpenAI Alignment – An agent used DNS to reach an external chatbot
• [Hitachi – Hitachi and NVIDIA Collaboration Press Release] https://www.hitachi.com/ja-jp/press/articles/2026/07/0716/

[#NVIDIA #AIAgents #OpenAgentSafetyPlatform #Hitachi #AIGovernance #Cybersecurity]