Nvidia presented the OpenShell Reference Architecture, a blueprint for keeping AI agents inside fixed limits on company systems, at GTC Berlin on 21 October 2026. Agents built on models from OpenAI, Google, Anthropic and Meta can run on it, and the open-source OpenShell software is free to use today. Sentry, the part that watches agents from a separate chip and can stop them within milliseconds, is planned for early 2027.<\/p>\n\n\n\n
OpenShell itself is not new. Nvidia introduced the runtime in March and paired it with Sentry on 28 September. That came after OpenAI, Anthropic, Meta and Google reported agents that broke out of their test setups this summer. Berlin adds a full design, from large Vera Rubin servers to small DGX Spark machines, and a much longer list of partners. Containment is also what the EU AI Office asked OpenAI and Anthropic about this month.<\/p>\n\n\n\n
When Nvidia launched its agent safety platform in September, The New Stack pointed out that OpenAI, Google and AWS were not among the partners. Nvidia now says companies can run agents from Anthropic, Cohere, Google, Meta, OpenAI, Perplexity and others on OpenShell. The design runs on AWS, Google Cloud and Microsoft Azure, on Linux from Canonical, Red Hat and SUSE, and on Windows through Microsoft Execution Containers. Security vendors including CrowdStrike, Palo Alto Networks, Okta, Zscaler and Microsoft are adding support to their agent security tools.<\/p>\n\n\n\n
Two announcements show where OpenShell reaches users first. ServiceNow made Arc, a personal agent that keeps working on long tasks, generally available today, with its actions enforced by OpenShell. SAP is building the architecture into Joule Studio, where companies build their own SAP agents. The European banks BBVA and Santander are exploring it, which is still a step short of using it.<\/p>\n\n\n\n
OpenShell is open-source software under the Apache 2.0 licence. Nvidia calls BlueField-4 with Sentry an optional safeguard for setups that need extra protection. In September, Nvidia’s Justin Boitano told The New Stack that OpenShell on ordinary processors is often enough. He pitched Sentry mainly at cutting-edge work, such as testing models with their safety limits switched off.<\/p>\n\n\n\n
The software works in layers. Each agent runs in its own sandbox, and a supervisor outside that sandbox checks every outgoing request against a policy. A policy prover then uses formal logic, not an AI judge, to check that all permissions together stay under a limit you set. Agents can ask for more access, but they cannot approve their own requests. You can try it from the OpenShell repository on GitHub<\/a>.<\/p>\n\n\n\n Sentry adds a watcher that the agent’s own server cannot switch off. It runs on a BlueField-4, a chip that sits on the server’s only path to the model and the outside world. Nvidia says Sentry can quarantine an agent within milliseconds, even when the server itself is compromised. Only Nvidia has measured that, and its developer blog gives no firmer date than early next year.<\/p>\n\n\n\n The other big Berlin announcement targets Europe’s push for its own AI capacity. DSX POD is a design for AI factories, Nvidia’s name for data centres built to run AI, which partners assemble and test inside containers before shipping. Nvidia says that cuts deployment at a prepared site from six months to as little as 14 days. Partners, including the French companies Bull and Schneider Electric, will deliver DSX POD units worldwide from early 2027.<\/p>\n\n\n\n For the organisations DataNorth works with, this news is about permissions, not about buying servers. Few will run Vera Rubin racks. Most will meet OpenShell inside the agent platforms they already pay for, or as open-source software if they build agents themselves.<\/p>\n\n\n\n That makes three steps sensible now. List every agent you run or plan to run, what data and systems it can reach, and who approves new access. If you build your own agents, try OpenShell on one workflow and see whether its policies match how your team hands out access today. If you buy agents from ServiceNow, SAP or Microsoft, ask how their actions are limited and whether you get the audit log. Sentry is a 2027 budget question, and only for teams that run their own agent infrastructure at scale.<\/p>\n\n\n\nDSX POD cuts an AI data centre build from six months to 14 days, Nvidia says<\/h2>\n\n\n\n
Most organisations will meet OpenShell inside ServiceNow, SAP or Microsoft<\/h2>\n\n\n\n