NVIDIA OpenShell Security Moves Enforcement Off the Host. What Does That Job Without a DPU?

Summarize with:

ChatGPTClaudePerplexityGoogle AIGrok

NVIDIA OpenShell security rests on a certain principle: an agent should not be able to disable the control that restricts it, so that control cannot live on the same host. NVIDIA's Sentry enforces the rule in silicon on BlueField-4 DPUs. Palo Alto has shipped on BlueField, and CrowdStrike and Zscaler have announced plans to. 

The principle is right, but the open question is what plays the same role for workloads that do not run on a DPU.

What NVIDIA Announced

NVIDIA introduced OpenShell as an open-source runtime, licensed Apache 2.0, that sandboxes agents with deny-by-default policy, kernel-level isolation, and outbound traffic blocked unless explicitly allowed. It runs on the host alongside the agent.

On October 21, 2026, NVIDIA published the OpenShell Reference Architecture and added a second layer. NVIDIA Sentry runs on BlueField-4 DPUs, is built on NVIDIA DOCA, and provides what NVIDIA calls "continuous out-of-band monitoring of agent behavior" and "in-silicon security enforcement." If an agent tries to leave its software boundary, NVIDIA says Sentry "quarantines and stops it in milliseconds." In Vera Rubin POD systems the DPU sits on the node's path to the model, so it can enforce policy without the host's cooperation.

The reasoning is sound, and it helps to be precise about what each layer protects. OpenShell's boundary sits outside the model and the agent harness, which protects against an agent that misbehaves. 

But OpenShell runs on the host. If an attacker takes over the host itself, the sandbox and its network policy are software on a machine the attacker controls. A watchdog in separate hardware cannot be reached the same way, and that is the case Sentry is built for.

Three Vendor Responses

Three security vendors responded the same day.

Palo Alto said AI Runtime Security on BlueField DPUs is "now generally available across AI factory and industrial edge deployments," with policies "enforced in silicon" to protect against "a compromised host." That claim is scoped to those two environments.

CrowdStrike said its Sentry integration is planned. CrowdStrike's Daniel Bernard said "AI agents have already created a new attack surface, and guardrails alone won't stop an adversary."

Zscaler announced support for OpenShell and said DPU filters for "line-rate packet drops" are planned.

So one vendor has shipped and two have announced, and all three build on NVIDIA's argument that enforcement has to sit outside the host.

Where the DPU Does Not Reach

NVIDIA does not describe Sentry as required. Decrypt reported that NVIDIA calls BlueField-4 and Sentry an optional hardware safeguard for deployments that need protection beyond OpenShell's software boundaries. The same report says NVIDIA's technical post on Sentry lists its availability as early next year, even though the reference architecture is available now.

That leaves three kinds of deployment. Some will run OpenShell with Sentry. Some will run OpenShell alone, which means the sandbox and the agent share a host. And many agents will run with neither, in containers, serverless functions, and virtual machines on public clouds, in accounts the security team may not own.

NVIDIA's release lists cloud operating systems from Amazon Web Services, Google Cloud, and Microsoft Azure among the supported platforms. The release does not say whether a customer on a public cloud instance can put Sentry's DPU enforcement in front of their own workload. That is a question to put to NVIDIA and to your cloud provider before you assume the answer either way.

Where the answer is no, the control that sits outside the host has to come from somewhere other than a DPU. For network traffic, that leaves one place to look. A compromised agent that cannot reach its model provider, an MCP server, or an attacker's server has lost most of what makes it dangerous, and every one of those connections crosses a network.

What Outside the Host Means Without a DPU

The property that matters is that a compromised host cannot reach, alter, or switch off the control. A DPU achieves that by being separate hardware. For traffic, there is a second way to get it: enforce at a point on the network path between the workload and its destination.

A gateway in that path applies policy to every outbound connection the agent makes, and the policy is held at the gateway, not on the workload. A process that takes over the workload can still try to open a connection. It cannot rewrite the rule that decides whether the connection leaves.

Aviatrix's Distributed Cloud Firewall works this way. It enforces default-deny at the spoke gateway in the agent's VPC or VNet, covering tool calls, MCP server connections, model provider traffic, and code interpreter outbound. No agent is installed in the workload, and no code changes are required. Aviatrix CEO Doug Merritt described the purpose when the company announced its containment platform for AI agents: "Detection tells you what happened. Containment determines how bad it gets."

This covers traffic leaving the workload. It does not watch what happens inside the host, and it does not replace the sandbox. That job belongs to OpenShell.

Three Layers with Three Different Jobs

OpenShell isolates the agent on the host. Sentry watches the host from separate silicon where the hardware exists. The network path decides where traffic is allowed to go, on any workload that has a route out.

Each covers what the others do not. An organization running OpenShell on a DPU-equipped AI factory and agents in a public cloud will likely need two of the three, and different workloads will need different pairs. A comparison of the four places destination control can be enforced lays out what each one sees and misses.

Three Questions to Ask

Put these to any vendor claiming to enforce outside the host.

• If the host is compromised, what still enforces?

• Where does that enforcement run if I have no DPU?

• What happens to a destination I did not list?

If you are evaluating OpenShell, decide workload by workload whether you will run Sentry. For each workload that will not have a DPU, write down what stops an outbound connection if the host is compromised. If the answer is another process on the same host, that workload is the gap to close first.

Learn more about how you can enforce default-deny for all communication paths without breaking production.