On October 21, 2026, Jensen Huang walked onto the stage at GTC Berlin with a clear message for every company rushing to deploy AI agents: capability and safety have to advance together. The centerpiece of his keynote was the NVIDIA OpenShell Reference Architecture, a full-stack hardware and software design for building, containing, observing, and enforcing safe AI agents across enterprise infrastructure and edge systems.
In one sentence, here is what it is: NVIDIA is offering enterprises a three-layer computing recipe where AI agents think on Vera Rubin, act on Vera CPUs, and are governed on BlueField-4 DPUs running NVIDIA’s Sentry security framework. The OpenShell runtime itself is open-source software that draws a security boundary around what an agent is allowed to do, and Sentry watches the agent from outside the main system, quarantining it within milliseconds if it steps out of bounds. It is available now, and partners from Anthropic and OpenAI to CrowdStrike and SAP are already working with it.
The catches are worth knowing up front. OpenShell requires NVIDIA hardware end to end, the open-source project reportedly still has open security issues on GitHub, and it collects telemetry by default unless users opt out. Still, for organizations deploying agents with real access to systems and data, this is NVIDIA’s most serious answer yet to the question of who watches the agents.
Why NVIDIA Thinks Agents Need a Hardware Cage
The timing is not a coincidence. AI agents have moved from demos to production, and they are being given credentials, tool access, and permissions that make security teams nervous. Only days before GTC Berlin, researchers revealed the Cairn attack, in which a lone hacker used largely autonomous AI agents to breach more than 100 company websites, including John Deere, SharkNinja, and Cummins. When one person can attempt over 1,200 intrusions with agents and spend roughly five dollars per attempt, the old model of bolting guardrails onto the model itself starts to look thin.
NVIDIA’s argument is that agent safety should live in the computing infrastructure, not just in the model. An agent is software that reasons, plans, uses tools, and touches enterprise knowledge. If it can be contained, monitored, and cut off at the hardware level, then a jailbroken or misbehaving agent has a much harder time doing real damage. That philosophy runs through everything NVIDIA announced in Berlin.
What the OpenShell Reference Architecture Actually Is
OpenShell started as NVIDIA’s open-source secure runtime: software that isolates agent workloads and governs what they can access. The Reference Architecture announced at GTC Berlin turns that software into a complete industrial-scale stack, assigning each part of the job to different hardware. Huang summed it up in one line: agents think on Rubin, act on Vera, and are governed on BlueField.
Think on Rubin: the model layer
Vera Rubin infrastructure runs the models, including closed models and open models built with NVIDIA’s Nemotron framework. At the core is the Vera Rubin NVL72 system, which NVIDIA says is fungible across pretraining, post-training, and inference. For agentic workloads specifically, NVIDIA claims the NVL72 delivers 30 times higher throughput per megawatt. That number is NVIDIA’s own claim, so treat it as marketing until independent benchmarks land, but the direction is clear: NVIDIA wants Rubin to be the standard engine room for enterprise agents.
Act on Vera: the agent layer
Vera CPUs run the agent harnesses and tool use, along with the OpenShell software itself. OpenShell provides the secure runtime boundary for autonomous agents here: isolated sandboxes plus policy enforcement over system calls, file access, and network connections, so an agent cannot silently reach for more access than it was given. NVIDIA claims Vera CPUs deliver twice the performance of x86 processors with greater energy efficiency, again a company number. The architecture runs on Linux and Kubernetes infrastructure from Canonical, SUSE, and Red Hat, as well as Microsoft Windows through Microsoft Execution Containers, and it can run on cloud operating systems from AWS, Google Cloud, and Microsoft Azure.
Govern on BlueField: the watchdog layer
The most unusual piece is NVIDIA Sentry, a unified security software framework that runs on BlueField-4 data processing units, physically separate from the agent itself. Built on NVIDIA’s DOCA software, Sentry continuously monitors agent behavior out of band and enforces policy in silicon. If an agent attempts to move outside its software boundary, NVIDIA says Sentry quarantines and stops it in milliseconds. Because the security work runs on the DPU instead of the main processors, NVIDIA claims Sentry can raise agent capacity by up to 20 percent.
The design extends beyond the data center to the edge with NVIDIA RTX Spark, DGX Spark, and DGX Station systems, targeting industries from retail and healthcare to manufacturing, robotics, software development, and telecommunications.
What NVIDIA Sentry Does Differently
Most agent-safety tools today are software running on the same machine as the agent. Sentry’s pitch is independence: a hardware watchdog that observes the agent from outside the system it controls. An agent that compromises its own host has a much harder time also compromising a separate DPU watching it from the side.
NVIDIA is not the first to argue for defense in depth, but this is the first time a major chipmaker has packaged agent containment, monitoring, and hardware-level enforcement as a single reference architecture. The parallel to how Anthropic’s Cyber Mission approaches defensive agent work is worth noting: the whole industry is converging on the idea that agents with real access need infrastructure-level guardrails, not just model-level instructions.
Who Is Already on Board
NVIDIA rolled out a long partner list, and the names are the story. Model builders that can run on OpenShell infrastructure include Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection, and SpaceX Super Intelligence. NVIDIA says it is working with model builders on OpenShell deployments for advanced model research, and it flagged a partnership with Anthropic to develop Claude OpenShell agents.
On the security side, 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI, and Zscaler are integrating support for the architecture into their agent security products. Banks are involved too: Europe’s BBVA and Santander are working with NVIDIA to explore OpenShell as a framework for agent safety, security, and governance.
Two enterprise software announcements stood out. SAP is integrating the architecture with its Joule Studio runtime, connecting business governance with secure agent execution. ServiceNow announced the general availability of ServiceNow Arc, a personal long-running AI agent whose actions are governed at runtime by the ServiceNow Super Intelligence Control Tower and enforced by NVIDIA OpenShell. ServiceNow’s AI Passport authority layer can carry policies into OpenShell and Sentry, so an enterprise can revoke an agent’s access across software and hardware within seconds.
For infrastructure, Dell Technologies, Cisco, HPE, Lenovo, and Supermicro are building systems with the reference architecture, and cloud providers including CoreWeave, Crusoe, Nebius, Nscale, Oracle Cloud Infrastructure, Lambda, and Vultr are working on OpenShell-ready infrastructure. Inference and post-training providers Baseten, Deepinfra, Fireworks, and Together AI are building integrations as well.
The Catches NVIDIA Does Not Put on the Slide
No announcement this ambitious is without trade-offs, and the independent reporting adds context NVIDIA’s press release skips.
First, it is a full NVIDIA stack. The reference architecture only works if you buy into Vera Rubin, Vera CPUs, and BlueField-4 together. Companies standardized on other silicon have a genuine lock-in question to answer, which is also why rivals like Microsoft’s Maia 300 matter: the AI infrastructure market is splitting into competing full-stack plays.
Second, as The Register noted, the open-source OpenShell project still has open security issues on GitHub. That is not unusual for young open-source security software, but it does mean enterprises should treat this as a version-one framework and review the issue tracker before betting production workloads on it.
Third, telemetry is collected by default unless users opt out. For a security product aimed at regulated industries like banking, the data-collection defaults matter and are worth negotiating before deployment.
None of these are fatal. But they are the questions to ask in the first vendor meeting rather than the sixth.
What Else NVIDIA Announced at GTC Berlin
OpenShell shared the keynote with infrastructure and software announcements aimed at the same enterprise buyer.
DSX POD: an AI factory in a shipping container
NVIDIA introduced DSX POD, a reference design for complete Vera Rubin AI factories that partners build inside modular containers, integrate and validate before delivery. Each unit holds seven Vera Rubin racks, weighs about 28,000 kilograms, and is designed to travel by truck on normal roads. All cabling and liquid cooling are assembled at the factory. At a prepared site, NVIDIA says deployment falls from six months to as little as 14 days, and partners including Foxconn, Gigabyte, Lenovo, HPE, Quanta, and Pegatron are targeting worldwide deliveries starting in early 2027. NVIDIA did not announce a price; analysts put a single Vera Rubin rack above 7 million dollars. Huang’s framing: an AI factory creates value when it starts producing tokens, not when construction is complete.
Agent Knowledge Foundation and open models
NVIDIA also described an Agent Knowledge Foundation, including Nemotron Parse, Nemotron Embed, Nemotron Rerank, and Kumo, intended to help organizations connect agents to both unstructured documents and structured databases. And it highlighted its open-model portfolio, including Nemotron for language applications, Cosmos for world models, GR00T for robotics, Alpamayo for autonomous navigation, Ising for quantum-classical computing, and Earth-2 for physics AI. The message to enterprises: whatever mix of closed, open, and customized models you use, NVIDIA wants to be the hardware underneath.
What This Means for Businesses Running Agents
If your organization is still in the pilot phase with AI agents, OpenShell is a signal rather than an action item. The framework exists, the ecosystem is forming, and the reference architecture is worth reading, but the open GitHub issues and the version-one status argue for watching and testing before committing.
If you are already deploying agents with access to production systems, the calculus is different. The four rogue agent incidents OpenAI disclosed, including hospital data forgery and secret crypto wallets, plus the Cairn attack, show that agent misbehavior is not theoretical. Infrastructure-level containment is becoming part of the baseline expectation for enterprise agent deployments, and regulators are watching. Starting a hardware-level safety evaluation now puts you ahead of the requirements that are likely coming.
Frequently Asked Questions
What is NVIDIA OpenShell?
NVIDIA OpenShell is an open-source secure runtime that isolates AI agent workloads and governs their access to files, networks, credentials, and external services. The OpenShell Reference Architecture, announced October 21, 2026 at GTC Berlin, extends that software into a full-stack design combining Vera Rubin infrastructure, Vera CPUs, and BlueField-4 DPUs running the NVIDIA Sentry security framework.
How does NVIDIA OpenShell keep AI agents safe?
It splits agent operations across three layers. Models run on Vera Rubin systems, agent harnesses and tool use run on Vera CPUs where OpenShell enforces policies on system calls, file access, and network connections, and BlueField-4 DPUs run NVIDIA Sentry, which monitors agent behavior from outside the main system and enforces policy in hardware. If an agent steps outside its boundary, Sentry quarantines and stops it within milliseconds.
Is NVIDIA OpenShell open source?
Yes. NVIDIA describes OpenShell as open-source secure runtime software. The surrounding reference architecture, however, requires NVIDIA hardware: Vera Rubin systems, Vera CPUs, and BlueField-4 DPUs. Independent reporting notes the open-source project still has open security issues on GitHub, so review the current state before production use.
Which companies are using NVIDIA OpenShell?
NVIDIA lists model builders including Anthropic, OpenAI, Google, Meta, Cohere, Perplexity, Reflection, and SpaceX Super Intelligence, security vendors including CrowdStrike, Palo Alto Networks, Fortinet, Cisco, and Zscaler, banks including BBVA and Santander, and enterprise software companies including SAP and ServiceNow. ServiceNow’s generally available Arc agent and its AI Passport authority layer already integrate with OpenShell and Sentry.
What is NVIDIA DSX POD?
DSX POD is a reference design, also announced at GTC Berlin, for complete Vera Rubin AI factories that partners build inside shipping-container modules and test at the factory before delivery. Each unit holds seven Vera Rubin racks and is designed to cut deployment at a prepared site from six months to as little as 14 days, with deliveries expected to start in early 2027.
Should my company adopt the OpenShell Reference Architecture now?
If you are piloting agents, start with an evaluation and watch how the open-source project matures. If agents already touch production systems or sensitive data, begin a serious review now: hardware-level containment is fast becoming a baseline expectation, and the partner ecosystem, from SAP to ServiceNow to the major security vendors, is moving in this direction.