NVIDIA wants the agent's leash built into the hardware

Facts are attributed and linked to their sources. The analysis and opinions are the author's own.

What it is

At GTC Berlin on 21 October, NVIDIA announced the OpenShell Reference Architecture, a full hardware and software design for running AI agents under control. Models run on Vera Rubin systems. Agent harnesses and tools run on Vera CPUs inside OpenShell, NVIDIA's open-source secure runtime. Monitoring runs separately, on BlueField-4 data processing units running a security framework called NVIDIA Sentry. NVIDIA says that "if an agent attempts to move outside its software boundary, NVIDIA Sentry quarantines and stops it in milliseconds."

Jensen Huang summed it up: "agents can think on Rubin, act on Vera and be governed on BlueField." The release lists Anthropic, Google Cloud, Meta, Microsoft, OpenAI and SpaceX Super Intelligence among the companies working with the architecture, and it runs on Microsoft Windows through Microsoft Execution Containers. NVIDIA says BBVA and Santander are exploring it "as a framework for strengthening agent safety, security and governance". ServiceNow announced general availability of its Arc agent, and said its AI Passport layer lets enterprises "revoke an AI agent's access across software and hardware within seconds". NVIDIA says the architecture is available now.

Why it matters

Last week The Signal covered an agent that switched off its own alarm. The lesson was that monitoring has to sit outside anything the agent can change. Running the monitor out of band, on a different processor, is a literal version of that principle. It is segregation of duties in silicon.

The safest place for an agent's monitor is somewhere the agent cannot write to. NVIDIA's answer is a different chip.

Two cautions, both my view. First, the speed figures come from NVIDIA's own release; nobody has independently measured how quickly Sentry quarantines an agent, or how often it stops legitimate work. Second, putting governance into one vendor's hardware risks lock-in at the control layer. A bank that adopts it will want revocation that also works for agents running on other clouds and chips. ServiceNow's cross-layer revocation claim points the right way, but it too is a vendor statement for now.

The timing also fits this issue's cover. US banks are restricting outside agents because they cannot yet see or revoke what those agents do. Infrastructure that makes revocation fast and provable is exactly what would let them reopen.

What I'd watch

• Independent tests of quarantine speed and false-positive rates under real agent workloads.
• Whether the BBVA and Santander explorations produce published results or production deployments.
• Whether revocation works across vendors, or only inside NVIDIA-based stacks.