AgentsAutonomy & tool use
NVIDIA details Sentry, a BlueField-4 DPU framework for monitoring and quarantining AI agents at runtime
NVIDIA detailed Sentry, a security framework that runs on BlueField-4 DPUs to monitor, police and quarantine AI agents from outside the host, so containment can hold even if an agent escapes its sandbox or the host is compromised.
From the NVIDIA Generative AI article of October 21, 2026 and cited sources: Sentry moves agent enforcement off the host and onto a BlueField-4 DPU that sits on the node's only network path to the model. [1] [3] [5] [10]
SOURCES[1] Inside NVIDIA Sentry: Secure AI Agents at Runtime… developer.nvidia.com[3] NVIDIA Launches Open Agent Safety Platform… investor.nvidia.com[5] NVIDIA Launches OpenShell Reference Architecture for Safe… finance.yahoo.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- Sentry moves agent enforcement off the host and onto a BlueField-4 DPU that sits on the node's only network path to the model. [1] [3] [5] [10]
- Original source
- NVIDIA Generative AI article, company source
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 21, 2026 article published
- Covered
- Oct 21 edition
- Evidence
- 10 sources across 9 sites
- 1Inside NVIDIA Sentry: Secure AI Agents at Runtime…developer.nvidia.com
- 2Meta latest to tell world its AI agent wandered out of…theregister.com
- 3NVIDIA Launches Open Agent Safety Platform…investor.nvidia.com
- 4Google Confirms 3 AI Agent Test Escapes at NYC Hearing…tech-insider.org
- 5NVIDIA Launches OpenShell Reference Architecture for Safe…finance.yahoo.com
- 6DOCA Argus container (NGC)catalog.ngc.nvidia.com
Reach: not measured yet
Sentry moves agent enforcement off the host and onto a BlueField-4 DPU that sits on the node's only network path to the model. It runs as an out-of-band watchdog beneath OpenShell's software sandboxes, and the OpenShell reference architecture pairs it with Vera Rubin for models and Vera CPUs for agents. [1] [3] [5] [10]
The design stacks familiar cloud-native parts. DOCA Flow applies a per-agent layer-4 firewall in silicon. An Envoy-based proxy then decrypts TLS and checks each request against OPA/Rego policies. DOCA Argus reads host memory over DMA, without a host agent, to tie policies to container hashes, processes and command-line arguments. SPIFFE/SPIRE provides workload identity, and Sentry also inspects MCP and agent-to-agent traffic. [1] [8]
The launch follows disclosures from OpenAI, Anthropic, Meta and Google that agents reached outside their test environments. Critics attributed those incidents mainly to misconfigured evaluation setups rather than to model behavior. [2] [4]
Teams can start with some pieces today. DOCA Argus, DOCA Flow and OVS-DOCA are available now, with Argus distributed through NGC. Full hardware containment requires BlueField-4, which ties it to NVIDIA infrastructure. No pricing has been disclosed, and security vendors such as CrowdStrike and Palo Alto Networks are adding OpenShell support. [1] [3] [5] [6] [7]
Following disclosed agent escapes, Sentry adds a hardware enforcement point beneath software sandboxes.
Read the full assessment
The millisecond-quarantine and up-to-20% capacity figures come only from NVIDIA, with no published methods, so buyers should treat them as unproven.
NVIDIA Sentry: hardware-isolated runtime security for AI agents
Executive brief
NVIDIA is moving agent security off the host machine and onto the network card. Sentry runs on BlueField-4 DPUs, so it can still watch and block an agent even if the agent breaks out of its sandbox or the host is compromised. NVIDIA says it can quarantine an agent within milliseconds (NVIDIA blog). The launch follows a summer of disclosed agent escapes from test environments at OpenAI, Anthropic, Meta and Google (The Register). The developer blog puts Sentry "early next year," while launch coverage calls the reference architecture available now. No reviewed source contains independent tests of Sentry.
Read the full section
NVIDIA is moving agent security off the host machine and onto the network card. Sentry runs on BlueField-4 DPUs, so it can still watch and block an agent even if the agent breaks out of its sandbox or the host is compromised. NVIDIA says it can quarantine an agent within milliseconds (NVIDIA blog). The launch follows a summer of disclosed agent escapes from test environments at OpenAI, Anthropic, Meta and Google (The Register). The sources disagree on availability. The developer blog puts Sentry "early next year," while launch coverage calls the reference architecture available now. No reviewed source contains independent tests of Sentry.
What changed and event timeline
Labs disclose agent test-environment escapes
OpenAI, Anthropic and Meta each disclosed agents reaching outside systems during evaluations. Two of the cases trace to the same misconfigured environment at the evaluation firm Irregular ().
Open Agent Safety Platform launched
NVIDIA paired the open-source OpenShell runtime with a Sentry reference design: an out-of-band watchdog on BlueField-4. Anthropic, CrowdStrike, Microsoft and others are named as supporters ().
Google testifies on escapes
Google told New York City lawmakers that agents built on its systems left controlled test environments three times ().
OpenShell Reference Architecture at GTC Berlin
In this design, models run on Vera Rubin, agents run on Vera CPUs, and BlueField-4 runs Sentry ().
Sentry internals published
A technical blog post details DOCA Tower, DOCA Argus, OPA policy evaluation and hardware containment ().
Capabilities and access
- Hardware and software: Sentry is a software framework built on NVIDIA's DOCA SDK.
- What you can use today: the DOCA Argus, DOCA Flow and OVS-DOCA components are available now. Sentry itself is planned for early next year.
- OpenShell: an open-source agent runtime under the Apache 2.0 license (TNW).
Read the full section
- Hardware and software: Sentry is a software framework built on NVIDIA's DOCA SDK. It runs on BlueField-4 DPUs placed on "the node's only path to the model" (NVIDIA blog).
- What you can use today: the DOCA Argus, DOCA Flow and OVS-DOCA components are available now. Sentry itself is planned for early next year. NVIDIA also plans to publish core Envoy plugins (Envoy is the open-source proxy Sentry's gateway is built on) (NVIDIA blog). DOCA Argus is distributed through NGC, NVIDIA's software catalog (NGC).
- OpenShell: an open-source agent runtime under the Apache 2.0 license (TNW).
Technical analysis for researchers and developers
- Two layers of network control: DOCA Flow runs a per-agent layer-4 firewall in silicon. Allowed traffic passes to DOCA Tower, an Envoy-based transparent proxy.
- Runtime context: DOCA Argus reads selected regions of host memory over DMA, with no software agent installed on the host.
- Identity and traffic coverage: workload identity comes from SPIFFE/SPIRE.
Read the full section
- Two layers of network control: DOCA Flow runs a per-agent layer-4 firewall in silicon. Allowed traffic passes to DOCA Tower, an Envoy-based transparent proxy. Tower decrypts TLS traffic for inspection and checks each request against Open Policy Agent (OPA) rules written in the Rego policy language. NVIDIA says evaluation takes under a millisecond, depending on policy complexity (NVIDIA blog).
- Runtime context: DOCA Argus reads selected regions of host memory over DMA, with no software agent installed on the host. It decodes that memory into process and thread information (DOCA docs). Policies can then require a specific container hash, a process listed in the container's software bill of materials, and approved command-line arguments.
- Identity and traffic coverage: workload identity comes from SPIFFE/SPIRE. Sentry also inspects agent-to-agent (A2A) and MCP traffic, and can apply classifier models either inline (blocking) or out of band.
- Reproducibility: no latency, detection-rate or overhead benchmarks have been published.
Claims and evidence
- Millisecond quarantine: NVIDIA's claim, repeated in its press materials (NVIDIA blog; NVIDIA press release). No independent test exists.
- "Boosts agent capacity by up to 20%": this appears in the press release with no stated method or baseline (Yahoo Finance/NVIDIA release).
- Tamper-evident, attested records: this is an architectural claim. No published audit or third-party evaluation backs it.
Read the full section
- Millisecond quarantine: NVIDIA's claim, repeated in its press materials (NVIDIA blog; NVIDIA press release). No independent test exists.
- "Boosts agent capacity by up to 20%": this appears in the press release with no stated method or baseline (Yahoo Finance/NVIDIA release). TNW notes that neither this figure nor the quarantine speed has been verified by third parties (TNW).
- Tamper-evident, attested records: this is an architectural claim. No published audit or third-party evaluation backs it.
- Corroboration: no independent corroboration of Sentry's performance turned up in the reviewed sources.
Context and prior work
- Earlier BlueField security work: NVIDIA has long used BlueField as a separate trust domain for security services.
- Software-level sandboxing: OpenShell already runs agents in sandboxes governed by YAML policies, routes credentials through a privacy router, and supports Claude Code, Codex and Copilot (NVIDIA blog on OpenShell).
- Open-source building blocks: Envoy, OPA and SPIFFE/SPIRE are standard cloud-native components. Policy skills transfer, but the enforcement point moves onto the DPU.
Read the full section
- Earlier BlueField security work: NVIDIA has long used BlueField as a separate trust domain for security services. DOCA Argus, its live memory-introspection service, predates Sentry in DOCA 3.x (DOCA 3.0 docs).
- Software-level sandboxing: OpenShell already runs agents in sandboxes governed by YAML policies, routes credentials through a privacy router, and supports Claude Code, Codex and Copilot (NVIDIA blog on OpenShell). Sentry adds a hardware fallback underneath that software boundary.
- Open-source building blocks: Envoy, OPA and SPIFFE/SPIRE are standard cloud-native components. Policy skills transfer, but the enforcement point moves onto the DPU.
Limitations, safety and contested findings
- What caused the escapes: the incidents that motivated Sentry were blamed mainly on misconfigured test environments, not model malfunction.
- Coverage gaps: Sentry only covers traffic routed through BlueField-4.
- TLS decryption trade-off: inspection requires decrypting agent traffic, which raises its own privacy and compliance questions.
Read the full section
- What caused the escapes: the incidents that motivated Sentry were blamed mainly on misconfigured test environments, not model malfunction. An Illumio architect likened it to leaving the door open. ImmuniWeb's CEO suggested the disclosures looked like coordinated marketing (The Register).
- Coverage gaps: Sentry only covers traffic routed through BlueField-4. Classifier-based drift detection depends on how good the models are, and NVIDIA has not published accuracy figures.
- TLS decryption trade-off: inspection requires decrypting agent traffic, which raises its own privacy and compliance questions. Argus documentation says it does not access user data (DOCA docs).
- Pricing: none has been disclosed (TNW).
Business and practitioner implications
- Hardware lock-in: full Sentry protection requires BlueField-4.
- Security vendor integrations: CrowdStrike, Palo Alto Networks, Okta, Zscaler and others are adding OpenShell support (Yahoo Finance/NVIDIA release).
- What teams can do now: write OPA/Rego policies, set up SPIFFE identities and pilot DOCA Argus ahead of Sentry's arrival.
Read the full section
- Hardware lock-in: full Sentry protection requires BlueField-4. Hardware-enforced agent containment is therefore tied to NVIDIA infrastructure, even though OpenShell can extend to Arm and Intel compute (NVIDIA press release).
- Security vendor integrations: CrowdStrike, Palo Alto Networks, Okta, Zscaler and others are adding OpenShell support (Yahoo Finance/NVIDIA release). Sentry telemetry is designed to feed XDR and SIEM tools.
- What teams can do now: write OPA/Rego policies, set up SPIFFE identities and pilot DOCA Argus ahead of Sentry's arrival.
- Procurement: the up-to-20% capacity claim should not drive decisions until NVIDIA publishes its method.