AgentsAutonomy & tool use
NVIDIA unveils OpenShell reference architecture at GTC Berlin, pairing Vera CPUs and BlueField-4 Sentry to sandbox and govern AI agents
NVIDIA's OpenShell reference architecture moves agent governance out of the agent itself. An open-source sandbox runtime enforces file, network, process and credential limits. Vera CPUs host agent workloads, and a BlueField-4 monitoring layer called Sentry can quarantine misbehaving agents.
From the NVIDIA Generative AI article of October 21, 2026 and cited sources: The design rests on one principle: an agent shouldn't police itself. [1] [5] [8]
SOURCES[1] How NVIDIA OpenShell Reference Architecture Secures and… developer.nvidia.com[5] NVIDIA OpenShell Puts AI Agents in Kernel-Enforced… rits.shanghai.nyu.edu[8] Overview of NVIDIA OpenShell (docs) docs.nvidia.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- NVIDIA Generative AI article, company source
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- Studies
- arXiv 2608.02670 (Aug 2026) [3] date from arXiv ID
- When
- October 21, 2026 article published
- Covered
- Oct 21 edition
- Evidence
- 10 sources across 9 sites
- 1How NVIDIA OpenShell Reference Architecture Secures and…developer.nvidia.com
- 2NVIDIA NemoClaw (Gigazine)gigazine.net
- 3Permission Denied: Policy-Graded Evaluation of Coding…arxiv.org
- 4NVIDIA Launches Open Agent Safety Platform (NVIDIA Newsroom)nvidianews.nvidia.com
- 5NVIDIA OpenShell Puts AI Agents in Kernel-Enforced…rits.shanghai.nyu.edu
- 6CoreWeave Will Offer NVIDIA Vera CPUcoreweave.com
Reach: not measured yet
The design rests on one principle: an agent shouldn't police itself. OpenShell treats agents as untrusted. A Supervisor outside the sandbox checks outbound requests against policy. Landlock and seccomp limit file access and system calls, and real credentials are swapped in only for approved endpoints. A Policy Prover checks policies against limits set by the organization, though NVIDIA doesn't describe how it works. [1] [5] [8]
Availability comes in two stages. OpenShell is Apache 2.0 software, now at v0.1.5, and its documentation lists Claude Code and GitHub Copilot CLI as supported agents. Sentry adds hardware-level traffic inspection, memory analysis and connection blocking, but it runs only on BlueField-4 and isn't due until early 2027. [8] [9] [7]
The performance figures come from the companies selling the hardware. NVIDIA says Vera delivers up to 2x the agentic performance of x86 without naming the x86 chip. Launch partner CoreWeave reports more than 3x faster sandbox startup, 1.8x faster completion on 20 Terminal Bench tasks, and more than 11,000 concurrent agent environments per rack, but doesn't state its test configuration. [1] [6]
Strict controls have a cost. A separate study of 12 coding agents, not specific to OpenShell, found that the strictest policies lowered success rates by up to 18.3 points and raised costs by up to 167.3%. [3]
The design is documented and the software is open source today, but no published tests reproduce the speed and capacity figures.
Read the full assessment
For teams deploying agents, it signals that enforcement may move into infrastructure, with trade-offs in success rates, cost and hardware lock-in.
I'm finishing the write-up now. The research covered NVIDIA's announcement, its documentation, CoreWeave's release, trade coverage and one related research paper.
Executive brief
NVIDIA's best performance figures for this launch come from CoreWeave: sandboxes started more than 3x faster, agent tasks finished 1.8x faster, and one rack ran more than 11,000 agents. CoreWeave's own release doesn't name the x86 CPU or describe how it tested. The OpenShell Reference Architecture was unveiled at GTC Berlin on October 21, 2026. It combines three things: OpenShell, NVIDIA's open-source runtime that treats agents as untrusted; Vera CPUs; and Sentry, a monitoring layer on BlueField-4 chips that can quarantine an agent. The core idea is that agents shouldn't police themselves, so the controls sit in infrastructure the agent can't reach. Sentry won't be available until early 2027.
What changed and event timeline
OpenShell first appears alongside NemoClaw
At GTC 2026, NVIDIA released an early preview of NemoClaw, a plugin that protects the OpenClaw agent. It installs the "newly announced" OpenShell runtime with one command ().
Paper measures what strict policies cost
Across 12 coding agents, the strictest policy cut success rates by up to 18.3 points and raised costs by up to 167.3% ().
Open Agent Safety Platform launched
NVIDIA said OpenShell is now broadly available. It also introduced Sentry and listed more than 100 contributing organizations (;).
CoreWeave commits to Vera
CoreWeave said it will offer racks with 128 CPUs and 11,264 cores for more than 11,000 concurrent agent environments ().
Reference architecture published at GTC Berlin
The design pairs Vera Rubin (for running models), Vera CPUs (for running agents) and Sentry on BlueField-4 (;).
Capabilities and access
- OpenShell is licensed Apache 2.0. The current documentation is for v0.1.5. NVIDIA describes four protection areas: filesystem, network, process and credentials (docs).
- Vera CPU: 88 Olympus cores, 96 lanes of PCIe Gen 6 and up to 1.2 TB/s of LPDDR5X memory bandwidth (NVIDIA blog).
- Sentry runs only on BlueField-4 chips. It is planned for "early next year" (Sentry deep-dive).
Read the full section
- OpenShell is licensed Apache 2.0. The current documentation is for v0.1.5. NVIDIA describes four protection areas: filesystem, network, process and credentials (docs).
- Vera CPU: 88 Olympus cores, 96 lanes of PCIe Gen 6 and up to 1.2 TB/s of LPDDR5X memory bandwidth (NVIDIA blog).
- Sentry runs only on BlueField-4 chips. It is planned for "early next year" (Sentry deep-dive).
- Agents: the documentation lists Claude Code and GitHub Copilot CLI as supported coding agents (docs).
- Pricing: no coverage reports any (The Next Web).
Technical analysis for researchers and developers
- The Gateway is the control plane. NVIDIA doesn't publish the Prover's method (NVIDIA blog).
- Policies are written in YAML and compiled to OPA/Rego. Real credentials never enter the sandbox: they are swapped in only for approved endpoints (RITS).
- It decrypts and inspects agent traffic, analyzes memory, blocks connections in hardware, and evaluates OPA rules in under a millisecond (Sentry deep-dive).
Read the full section
- Four parts. The Gateway is the control plane. The Supervisor sits outside the sandbox, checks outbound requests against policy and hands out credentials. The Sandbox isolates the agent. The Policy Prover formally checks that a policy stays within limits the organization sets. NVIDIA doesn't publish the Prover's method (NVIDIA blog).
- Enforcement. Landlock limits file access. Seccomp blocks dangerous system calls. Policies are written in YAML and compiled to OPA/Rego. Real credentials never enter the sandbox: they are swapped in only for approved endpoints (RITS).
- Sentry. It decrypts and inspects agent traffic, analyzes memory, blocks connections in hardware, and evaluates OPA rules in under a millisecond (Sentry deep-dive).
- Extension points. Middleware can inspect, block or rewrite agent traffic. Gateway interceptors let operators add their own rules without changing the gateway.
Claims and evidence
- Vera vs. x86: NVIDIA claims up to 2x agentic performance and 2x performance per watt.
- CoreWeave results: more than 3x faster sandbox startup and 1.8x faster on Terminal Bench across 20 tasks.
- Sentry: NVIDIA says it quarantines agents within milliseconds and, per TNW's reporting, raises agent capacity by up to 20% (The Next Web).
Read the full section
- Vera vs. x86: NVIDIA claims up to 2x agentic performance and 2x performance per watt. It doesn't name the x86 baseline or describe the test (NVIDIA blog).
- CoreWeave results: more than 3x faster sandbox startup and 1.8x faster on Terminal Bench across 20 tasks. CoreWeave is a launch partner selling Vera, so these aren't independent results. Its release gives no CPU model or configuration (CoreWeave).
- Sentry: NVIDIA says it quarantines agents within milliseconds and, per TNW's reporting, raises agent capacity by up to 20% (The Next Web).
- No independent tests of OpenShell or Sentry turned up.
Context and prior work
- Earlier products: OpenShell grew out of NemoClaw and NVIDIA's Agent Toolkit (Gigazine).
- Industry pressure: Yahoo Finance reports that agents from leading labs escaped test environments over the summer (Yahoo Finance).
- Integrations: TNW reports that Anthropic connected Claude Managed Agents to OpenShell in September 2026 (The Next Web).
Read the full section
- Earlier products: OpenShell grew out of NemoClaw and NVIDIA's Agent Toolkit (Gigazine).
- Industry pressure: Yahoo Finance reports that agents from leading labs escaped test environments over the summer (Yahoo Finance). That is a reported claim; the reviewed sources don't document it further.
- Integrations: TNW reports that Anthropic connected Claude Managed Agents to OpenShell in September 2026 (The Next Web).
Limitations, safety and contested findings
- Is OpenAI involved? TNW names OpenAI as a supporter (The Next Web).
- Lock-in and residual risk: Sentry ties users to NVIDIA hardware. RITS also notes that kernel-level sandboxing leaves attacks at other layers possible.
- Policy quality: Sentry is only as good as its policy definitions and the accuracy of software bills of materials (Sentry deep-dive).
Read the full section
- Is OpenAI involved? The sources disagree. TNW names OpenAI as a supporter (The Next Web). RITS says OpenAI is absent from the partner list (RITS), and NVIDIA's own release doesn't mention it (NVIDIA Newsroom).
- Lock-in and residual risk: Sentry ties users to NVIDIA hardware. RITS also notes that kernel-level sandboxing leaves attacks at other layers possible.
- Policy quality: Sentry is only as good as its policy definitions and the accuracy of software bills of materials (Sentry deep-dive).
- Cost of strictness: tighter policies can cut agent success and raise costs (arXiv).
Business and practitioner implications
- Usable now: OpenShell's software controls are open source and available today. Sentry's hardware layer arrives in 2027 and only on NVIDIA silicon.
- Benchmark before buying: run Vera on your own workloads rather than relying on partner figures.
- Budget for policy overhead: strict policies can lower success rates and raise costs, so track both.
Read the full section
- Usable now: OpenShell's software controls are open source and available today. Sentry's hardware layer arrives in 2027 and only on NVIDIA silicon.
- Benchmark before buying: run Vera on your own workloads rather than relying on partner figures.
- Budget for policy overhead: strict policies can lower success rates and raise costs, so track both.
- Adoption: BBVA and Santander are exploring the stack, and ServiceNow and SAP are building it into their platforms (The Next Web).