NVIDIA announced the OpenShell Reference Architecture at GTC Berlin on Oct. 21, a blueprint for building data centers and edge systems where companies can run AI agents inside enforced limits.
The design builds on OpenShell, NVIDIA’s open-source runtime for sandboxing agents, and extends it to the hardware level. “As enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture,” Jensen Huang, NVIDIA’s founder and CEO, said in the announcement. “With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField.”
The layers
Each layer has a job, according to NVIDIA. Vera Rubin systems run the AI models.
Vera CPUs run the agent harnesses, the software that manages an agent’s steps and tool use. BlueField-4 DPUs, data processing units that sit on the network path, run NVIDIA Sentry, security software that watches agent behavior from outside the agent’s own system.
NVIDIA says that if an agent tries to move outside its software boundary, Sentry “quarantines and stops it in milliseconds.” The company describes this as in-silicon enforcement.
The architecture also reaches the edge, onto NVIDIA’s RTX Spark, DGX Spark and DGX Station machines. NVIDIA lists retail, healthcare, manufacturing, robotics and telecommunications among the industries it has in mind.
How OpenShell works
A post on NVIDIA’s technical blog by Hannah Coutand, Itay Ozery, Alex Sandu and Kirit Thadaka explains the software side. Their starting point is that “an agent cannot govern itself,” so security has to live in the infrastructure around it.
OpenShell treats every agent workload as untrusted and gives it access only to what it needs when it needs it, the engineers wrote. It has four parts.
A gateway manages sandboxes and their policies. A supervisor, running separately from the sandbox, checks outbound requests and controls access to credentials. The sandbox itself limits file and process access.
A policy prover formally checks that a policy’s permissions stay within a ceiling the organization sets.
The blog post also cites performance figures. NVIDIA says Vera CPUs, which have 88 cores, deliver up to twice the performance of x86 processors on key agent tasks. CoreWeave, a cloud provider, measured more than three times faster sandbox startup and 1.8 times faster completion of agent loops on Vera than on a leading x86 chip, according to the post, with a single rack supporting more than 11,000 agent environments at once.
NVIDIA’s announcement adds that Sentry running on BlueField-4 can increase agent capacity by up to 20%, and that Vera Rubin NVL72 systems deliver 30 times higher throughput per megawatt for agent work. These are NVIDIA’s own figures.
The architecture runs on Linux and Kubernetes from Canonical, SUSE and Red Hat, and on Microsoft Windows, NVIDIA says.
The company lists a long set of companies “working with” the design, including Anthropic, AWS, Cisco, CrowdStrike, Google Cloud, Meta, Microsoft, OpenAI, Palo Alto Networks, SAP and ServiceNow. NVIDIA didn’t say what each company’s work involves or when systems built to the design will be available to buy.
The OpenShell runtime itself is open source on GitHub. NVIDIA’s product page describes it as a runtime that limits an agent’s file system access, processes, network traffic and where its model requests can go.
Source: NVIDIA, “NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents”
Additional sources: NVIDIA Technical Blog, Hannah Coutand, Itay Ozery, Alex Sandu and Kirit Thadaka, “How NVIDIA OpenShell Reference Architecture Secures and Governs AI Agent Workloads at Scale”; NVIDIA, “NVIDIA OpenShell: Open, Secure Runtime for AI Agents”
