TechPrufer
Get started
NVIDIA
NVIDIA logoNVIDIA · Feature trail

Secure AI Agent Deployment

3 posts · May 2026 – Sep 2026

What this trail covers

This feature thread tracks the evolution of secure AI agent deployment, focusing on architectural controls to mitigate risks associated with connecting AI agents to live tools and corporate data. Initial efforts focused on identifying common failure modes such as inadequate access control, arbitrary code execution via agent tools, lack of network egress controls, and exposure of plaintext secrets. Subsequent developments have introduced deterministic controls like robust agent access controls, credential management, and formal policy analysis via NVIDIA OpenShell, enabling sandboxed execution and controlled service access without rewriting agents. Organizations like Cadence, Slack, and Gecko Robotics are adopting OpenShell for chip design, enterprise automation, and physical robotics governance.

All NVIDIA trails
  1. NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring | NVIDIA Technical BlogIntroduces the NVIDIA Open Agent Safety Platform, a reference design combining NVIDIA OpenShell (runtime with kernel-level isolation for agents) on Vera CPUs with NVIDIA Sentry (hardware-based monitoring and enforcement) on BlueField-4 DPUs. Details five core principles: verifiable policy, out-of-band enforcement, controlling the path to the model, scaling agent authority with reasoning visibility, and shared responsibility. Highlights NVIDIA Sentry's role in providing continuous, in-silicon monitoring and policy enforcement at line speed via BlueField hardware and DOCA, correlating agent interactions, policy decisions, and tool access for contextual activity records. This represents a significant advancement in providing a robust, layered, and hardware-assisted security framework for AI agents.
  2. Add Runtime Controls to AI Agents with NVIDIA OpenShell | NVIDIA Technical BlogIntroduces NVIDIA OpenShell 0.1.0, an open-source runtime that enforces access controls for AI agents without requiring agent code modification. Key contributions include: 1. Sandboxed execution with kernel-level filesystem and process controls. 2. Controlled service access via a supervisor that inspects outbound requests (HTTP, GraphQL, MCP) against defined policies, allowing read-only access while blocking writes. 3. Credential management, where real credentials are kept outside the agent workload and substituted only for authorized requests. 4. Formal policy verification using OPA/Rego to ensure permissions stay within defined boundaries. Demonstrates policy enforcement with a curl example against the GitHub API, showing how network access and specific API operations can be restricted. OpenShell components (Gateway, Supervisor, Sandbox) are detailed, along with multi-tenant platform support and integration with third-party security services.
  3. Building an Adaptive Agentic Cybersecurity System with NVIDIA Nemotron | NVIDIA Technical BlogThis post details the integration of NVIDIA Nemotron models (Nemotron 3 Ultra for orchestration, Nemotron 3 Super for detection generation) with CrowdStrike's agentic cybersecurity system (CrowdStrike SafeMind) to create a continuous offensive-defensive testing loop. It describes a specialized defensive harness with six mechanisms: schema knowledge base, telemetry grounding, specialized detection authoring, artifact linting, detection replay, and independent review. The system was evaluated in an isolated, representative environment modeled on NVIDIA accelerated computing infrastructure. Backtesting showed a 41.9% mean detection rate across six sessions, a 2.5x improvement over a baseline. Live-fire testing against eight unseen attacks demonstrated 45% generalization of open-model detections compared to 29% for the frontier system.
  4. Where Security Fits in an AI Agent Stack | NVIDIA Technical BlogThis post details the integration of security controls within an AI agent stack, specifically highlighting the role of NVIDIA OpenShell as a secure runtime layer. It introduces five design rules for enforceable agent security: higher layers propose actions while lower layers decide, policy remains below the security boundary, every effect is checked, access is just-in-time, and isolation enables recovery. It also defines four security profiles (Isolated, Connected, Production, Adversarial) that apply progressively stricter controls. The post emphasizes the distinction between behavioral controls (model, harness) and authoritative infrastructure controls (runtime), advocating for the runtime to be the ultimate arbiter of an agent's capabilities.
  5. Four Ways to Deploy More Secure AI Agents | NVIDIA Technical BlogThis post details four key architectural controls for secure AI agent deployment: 1. Implementing strong access controls to restrict agent access to authorized users and enforce least privilege. 2. Limiting code execution by avoiding command-line tools where possible, blocking writes outside non-executable workspaces, and using strict allowlists for executables in isolated environments. 3. Denying network egress by default with least-privilege allowlists for necessary endpoints. 4. Keeping persistent secrets out of the agent's reach by using dedicated secrets managers and retrieving secrets on demand with short-lived tokens. It highlights the unreliability of LLM-based defenses (e.g., LLM-as-a-judge) against adversarial techniques like social engineering and prompt injection, advocating for deterministic, architectural controls as the primary defense.
  7. How to Self-Host a Validated AI Coding Assistant with NVIDIA NeMo Guardrails | NVIDIA Technical BlogThis post details the implementation of a self-hosted, validated AI coding assistant using StarCoder2-7B NIM, NVIDIA NeMo Guardrails, and a CI verification gate. It addresses challenges of data sovereignty, package hallucination, and traceability by keeping the model endpoint internal, using NeMo Guardrails for policy enforcement (e.g., blocking requests for human-only files), integrating a CI stage for dependency scanning (SAST, secret scan, hallucinated-dependency scan, license scan), and establishing a Prometheus/Grafana metrics loop for outcome measurement. The architecture emphasizes that the model is not the control plane, with policy, verification, and measurement living outside the model.
  8. How to Govern Autonomous Agents in Enterprise AI Factories | NVIDIA Technical BlogThis post details the implementation of the NVIDIA Secure Agent Workspace Reference Design, which provides a secure environment for autonomous agents in enterprise AI factories. It outlines a two-phase approach: securing the perimeter outside the VM (provisioning managed workspaces, enforcing SSO, network lockdown, human approval for actions, centralized logging) and adding runtime security inside the VM (active sandboxing, signed security policies, credential protection via proxies, continuous verification). It also describes setting up agent blueprints and deploying the workspace on-premises or in the cloud.
  9. Build Personal AI Agents on Windows PCs with New Tools from Microsoft and NVIDIA | NVIDIA Technical BlogThis post details the integration of Microsoft eXecution Containers (MXC) and NVIDIA OpenShell for secure AI agent deployment on Windows PCs. MXC provides a policy layer for isolation and containment, preventing agents from accessing the full system. OpenShell integrates MXC for developers, offering capabilities like policy creation, inference routing, and PII obfuscation. The post also highlights performance improvements in agentic inference through optimizations in llama.cpp (Multi-Token Prediction, Programmatic Dependent Launch) and vLLM, as well as enhanced multi-GPU support for llama.cpp and ComfyUI on RTX PCs.
  10. Advancing AI Infrastructure for Agentic AI with NVIDIA DOCA In-Silicon Security | NVIDIA Technical BlogThis post details how NVIDIA BlueField DPUs and DOCA provide in-silicon security for AI factories. It introduces DOCA Argus for runtime threat detection, DOCA Vault for zero-trust access, and DOCA Flow for network enforcement. The BlueField DPU's hardware-enforced, isolated security layer operates independently of the host system, enabling monitoring and policy enforcement even if the host is compromised. This architecture aims to protect AI infrastructure, workloads, agents, and data at AI scale by operating at the speed of AI agents.
  11. NVIDIA-Verified Agent Skills Provide Capability Governance for AI Agents | NVIDIA Technical BlogThis post introduces NVIDIA-verified agent skills, a new layer of governance for AI agents. It details the verification process, which includes cataloging, daily updates, security scanning via SkillSpector (addressing both conventional software and agent-specific risks like prompt injection and excessive agency), cryptographic signing for verifiable provenance, and documentation via machine-readable skill cards. The skill cards provide transparency on ownership, dependencies, limitations, and verification status. This builds upon existing efforts like NVIDIA NeMo Guardrails and OpenShell by extending trust to agent capabilities themselves.