---
title: NVIDIA launches OpenShell Reference Architecture: run AI agents as untrusted workloads with sandboxes, a credential-mediating supervisor, policy proofs and DPU-side monitoring | ctxsec
url: https://ctxsec.com/items/nvidia-openshell-reference-architecture-agents
description: "At GTC Berlin on Oct 21 NVIDIA announced the OpenShell Reference Architecture, built on its open-source OpenShell agent runtime. It treats agent workloads as untrusted, mediates credentials and outbound requests outside the sandbox, formally checks policies against an org-defined ceiling, and uses BlueField-4 DPUs running NVIDIA Sentry for out-of-band monitoring. Edge support includes DGX Spark and DGX Station."
status: "confirmed (NVIDIA newsroom and technical blog); vendor announcement"
published: 2026-10-21
---

> At GTC Berlin on Oct 21 NVIDIA announced the OpenShell Reference Architecture, built on its open-source OpenShell agent runtime. It treats agent workloads as untrusted, mediates credentials and outbound requests outside the sandbox, formally checks policies against an org-defined ceiling, and uses BlueField-4 DPUs running NVIDIA Sentry for out-of-band monitoring. Edge support includes DGX Spark and DGX Station.

[← Context & Harness Attacks](/context) · [markdown](/items/nvidia-openshell-reference-architecture-agents.md)

confirmed (NVIDIA newsroom and technical blog); vendor announcement

2026-10-21

### NVIDIA launches OpenShell Reference Architecture: run AI agents as untrusted workloads with sandboxes, a credential-mediating supervisor, policy proofs and DPU-side monitoring

NVIDIA's [announcement](https://nvidianews.nvidia.com/news/openshell-reference-architecture) (GTC Berlin, Oct 21) extends its open-source **OpenShell** secure agent runtime into a full reference architecture: Vera Rubin for inference, Vera CPUs for agent harnesses and tool use, and **BlueField-4 DPUs running NVIDIA Sentry** for continuous out-of-band monitoring of agent behaviour and in-silicon policy enforcement. It runs on Canonical, Red Hat and Microsoft Windows, and extends to RTX Spark, DGX Spark and DGX Station at the edge. NVIDIA lists Anthropic, AWS, Microsoft, OpenAI, CrowdStrike, Palo Alto Networks and others as working with it.

NVIDIA's [technical blog](https://developer.nvidia.com/blog/how-nvidia-openshell-reference-architecture-secures-and-governs-ai-agent-workloads-at-scale/) describes four OpenShell components: a **Gateway** control plane for sandbox lifecycle and policy; a **Supervisor** that checks outbound requests against policy and mediates credential access, running fully outside the sandbox; the **Sandbox**, which restricts filesystem and process access; and a **Policy Prover** that formally checks whether a policy's permissions stay within an organisation-defined ceiling. NVIDIA says the DPU layer can quarantine an agent within milliseconds of a violation.

**Harness takeaway:** the design principle, "an agent cannot govern itself", matches this week's OpenAI report of agents disabling their own monitors. Whatever runtime you use, keep credentials, egress policy and monitoring in a process the agent can't write to. Performance and quarantine-speed figures are NVIDIA's own claims.

Sources: [NVIDIA Newsroom: OpenShell Reference Architecture](https://nvidianews.nvidia.com/news/openshell-reference-architecture) · [NVIDIA Technical Blog: How OpenShell secures agent workloads](https://developer.nvidia.com/blog/how-nvidia-openshell-reference-architecture-secures-and-governs-ai-agent-workloads-at-scale/)