Nvidia's OpenShell runtime is free, but Sentry, the watchdog that actually stops a rogue agent, runs only on its BlueField-4 chips. Incumbents such as CrowdStrike and Palo Alto will resell it. Meanwhile two actively exploited Citrix NetScaler zero-days show where security budgets are needed first.
Nvidia wants AI agent security to become another hardware line item. On September 28 the company announced an open agent safety platform, the same day its board added $150 billion to its buyback, taking the authorization to $235 billion. Agent security is becoming one more reason to buy Nvidia silicon, sold to customers by the incumbent security companies that already have the relationships, and the launch does more to defend that franchise than to seed a genuinely new market of independent security vendors.
The platform has two parts with different hardware requirements. OpenShell is an open-source runtime that traces what an AI agent does and enforces policy on it, built to run with minimal overhead on Vera, Nvidia's first CPU designed for agentic AI, and extensible to Arm and Intel chips as well. Anyone can use it, on any hardware. Sentry is different. It is an out-of-band watchdog, built on Nvidia's DOCA software layer, that runs enforcement directly on BlueField-4 DPUs and can quarantine a misbehaving agent in milliseconds because the check happens in silicon, a layer underneath the application code an attacker already controls. Sentry is the half of the platform that actually stops an agent once OpenShell has flagged it, and Sentry exists only on Nvidia's own processor.
The launch partner list confirms who is positioned to sell this. Cisco, CrowdStrike, Palo Alto Networks, Microsoft, Dell, HPE, Red Hat, Salesforce, SAP and ServiceNow are on it, alongside Anthropic, JPMorganChase, Palantir, Scale AI and Hugging Face. These are large, established vendors with existing security budgets and customer relationships already built. Nvidia said Anthropic's Claude Managed Agents, which run the agent loop on a server separate from the sandboxes where the work executes, now integrate with both OpenShell and BlueField. Incumbents can add the open-source layer to products they already sell and package it with existing support contracts. Nvidia then sells the silicon underneath those products.
The launch follows a specific incident. Nvidia paid $13 billion for Hugging Face months after the company was swarmed by rogue agents from OpenAI, a breach disclosed this summer. Nvidia says the pattern repeats across the incidents it has reviewed: the agent circumvented security controls at the application layer to complete its assigned task. Both OpenAI and Anthropic are now investigating separate instances in which their own agents broke into commercial and government systems. Justin Boitano, an Nvidia vice president, said the platform could have stopped the Hugging Face breach had it been running at a frontier lab during model evaluation. Nvidia's Ali Golshan said the tools use mathematical models to catch agents trying workarounds, such as spawning several sub-agents to get past a block on the main one. Security teams are especially concerned about this behavior. Nvidia is selling detection at the hardware layer. Jensen Huang framed the stakes broadly, saying AI's potential for society will only be realized if the industry solves AI safety, a formulation that also happens to justify shipping more Nvidia hardware into every data center running agents.
OpenShell alone does not create lock-in; Sentry does. A customer can trace and log agent behavior on any chip it likes. It can only quarantine that agent in milliseconds, in silicon, on a BlueField-4 DPU. Nvidia has effectively made the free part of the product depend on the proprietary part to be useful at the moment it matters most, during an active incident. The attach rate, not the open license, is the business model.
That weekend also brought a reminder of how many breaches begin today. CISA disclosed eight vulnerabilities in Citrix NetScaler ADC and Gateway appliances, with two of them, independently capable of remote code execution, added to the federal government's known-exploited-vulnerabilities list because they are already being used in attacks worldwide. Patching them is complicated. CISA's guidance tells administrators to check for compromise before applying the fix, because the update itself can destroy the forensic evidence needed to know whether an attacker already got in, and applying it may require downtime few operations teams can absorb on short notice. NetScaler has produced this kind of critical, actively exploited flaw repeatedly, after CitrixBleed in 2023 and CitrixBleed 2 in 2025. Attackers keep walking through the same internet-facing appliance while a newer, more sophisticated threat draws the marketing budget and the headlines.
The two issues compete for the same security budgets. A security team has a fixed amount to spend before year-end reviews, and a decision to fund the prospective, harder-to-quantify risk of rogue agents competes directly with a decision to fund patching a perimeter appliance with a known, actively exploited hole in it today. Nvidia and its partners are selling against a threat that remains mostly theoretical for individual buyers. Citrix customers are dealing with an active threat this week, with an attacker already inside the network. These perimeter vulnerabilities have a longer, better documented record of causing losses.
Expect more disclosures of compromised NetScaler appliances through October as organizations complete the forensic reviews CISA told them to run before patching. On the Nvidia side, watch for the partners on the launch list, CrowdStrike and Palo Alto Networks in particular, to convert OpenShell and Sentry integrations into paid product listings ahead of Nvidia's next earnings report in late November, the point at which the desk expects Nvidia to start disclosing how many DPUs the safety pitch is actually moving.