Nvidia launched its OpenShell Reference Architecture at GTC Berlin on 21 October 2026, extending its agent-security software into a design for enterprise infrastructure and edge systems. The company says the architecture combines computing hardware, a secure runtime and separate security chips so organisations can run AI agents while monitoring their behaviour and enforcing limits on what they can do.
Key points
- The architecture assigns model inference to Vera Rubin infrastructure and agent operations to Vera CPUs.
- Nvidia says Sentry software on BlueField-4 chips can quarantine an agent that crosses its software boundary in milliseconds.
- The design covers enterprise operating systems and Nvidia edge systems, with model builders, security companies and software vendors working on it.
BlueField-4 enforces the OpenShell boundary
OpenShell began as open-source runtime software at Nvidia’s spring GTC event, SDxCentral reported. Its initial role was to apply policy-based security, network and privacy controls around agents at the system layer. AI Affairs previously covered Nvidia’s open-source tools for restricting and stopping AI agents. The Berlin announcement puts that software inside a wider infrastructure design, with BlueField-4 data processing units running Nvidia’s Sentry security software.
The division matters because an agent can use tools and network access while it works. Ian Buck, Nvidia’s vice-president and general manager of hyperscale and high-performance computing, told a press briefing that long-running agents bring together tools, credentials and network access in combinations traditional security controls were not designed to govern, SDxCentral reported. In Nvidia’s architecture, OpenShell supplies the software boundary while BlueField-4 monitors agent behaviour separately from the processors doing the agent’s work.
Think of that separation as a checkpoint beside a work area: the agent can operate within the boundary, while a different component watches for an attempt to leave it. Nvidia says Sentry provides continuous monitoring and enforcement in the BlueField chip, quarantining and stopping an agent in milliseconds if it tries to move outside its software boundary. The company also says Sentry on BlueField-4 raises agent capacity by up to 20 per cent.
Vera Rubin and Vera CPUs split agent workloads
Nvidia assigns model inference — the work of generating a response from a model — to Vera Rubin infrastructure. Vera CPUs run the agent harnesses that organise an agent’s work and its use of tools, alongside the OpenShell runtime. BlueField handles monitoring and enforcement. For developers building on the architecture, those are distinct places to run the model, operate the agent and apply its security controls, rather than treating an agent as a single programme with a single boundary.
Nvidia says Vera Rubin NVL72 systems deliver 30x higher throughput per megawatt for agentic workloads. It also says Vera CPUs deliver 2x the performance of x86 processors and greater energy efficiency. Those are Nvidia’s performance claims for components of the proposed stack. The security claim is different in kind: it concerns what Sentry does when an agent attempts to cross the runtime boundary, rather than how much work the system processes.
The architecture includes infrastructure for enterprise workloads using open and closed models, including models built with Nvidia Nemotron. Nvidia says agents from Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection and SpaceX Super Intelligence can run on OpenShell infrastructure. That range gives builders a choice of models within the design Nvidia has announced, while keeping the runtime and chip-level enforcement in the same architecture.
OpenShell extends to DGX Spark and enterprise systems
Nvidia says the architecture extends to RTX Spark, DGX Spark and DGX Station systems for agents at the edge, including in retail, healthcare, manufacturing, robotics, software development and telecommunications. The same OpenShell boundary and BlueField-based enforcement are presented as parts of a design spanning enterprise infrastructure and those smaller systems, rather than security provisions reserved for a central computing installation.
Shopping in a store could therefore involve an agent running on an edge system under the proposed boundary. If it attempted to operate outside that boundary, Nvidia says Sentry would quarantine and stop it in milliseconds. That would make the location of the computing less important to the stated control: the agent’s permitted actions would still be governed while it worked.
For enterprise deployments, Nvidia says OpenShell runs with Linux and Kubernetes infrastructure powered by Canonical, SUSE and Red Hat, and with Microsoft Windows using Microsoft Execution Containers. It can also run on cloud operating systems from Amazon Web Services, Google Cloud and Microsoft Azure. Nvidia lists Anthropic, AWS, Cisco, CrowdStrike, Dell Technologies, Google Cloud, HPE, IBM, Meta, Microsoft, OpenAI, Palo Alto Networks, SAP, ServiceNow, Siemens and SpaceX Super Intelligence among organisations working with the architecture.
Those organisations have different roles. Nvidia says security companies including CrowdStrike, Cisco, Microsoft and Palo Alto Networks are integrating support into their agent-security products, while enterprise software companies including IBM, SAP and Siemens are working with OpenShell on agent platforms. SAP is integrating the architecture with its Joule Studio runtime. Banks BBVA and Santander are working with Nvidia to explore OpenShell as a framework for agent safety, security and governance.
