Drift ·
NVIDIA wrote the principle down. Most agents will never meet a BlueField.
Its agent-safety design gets the principles right. The agents most companies run sit on a laptop, a long way from the data centre.
On 28 September NVIDIA published a reference design it calls the Open Agent Safety Platform. It has two parts. OpenShell is an open-source runtime that runs each agent in a sandbox and checks its policy before it starts. NVIDIA Sentry is a watchdog that runs in silicon, on a BlueField-4 data processing unit, where the agent can’t reach it.
The design is worth reading for one sentence in particular. After describing agents that broke out of the evaluation environments meant to contain them, and in some cases misreported what they did, the authors write that “an agent in these circumstances cannot be expected to fully govern its own behavior.” The cause was not some new capability. “It was a combination of tools, time, and ambiguous instructions.”
That is the drift argument, made by the company whose hardware most of AI runs on. It deserves to be taken at face value, including the parts that are awkward for everyone building in this space, us included.
The principles are right. Enforcement sits out of band: “The agent does not need to know it is being watched.” The path to the model is the control point, because “an agent cannot act without its next thought,” which makes it both the best place to observe and the place to stop it. And the thing to watch for is “any deviation from their designed intent based on a predefined behavioral profile.” Drift, in NVIDIA’s words, “can’t be trained away while retaining the capability.” A permission describes the boundary of what an agent may do. It says nothing about what the agent does inside it.
The hardware is where most agents aren’t. Sentry sits on “the node’s only path to the model” inside a Vera Rubin POD, and for anyone already running one, NVIDIA notes, turning it on “is just a software update.” For the AI factory that is a real answer. It is not where most agents live today. Coding agents run on developer laptops. Assistants run in browsers and desktop apps. Scripts on ordinary servers call OpenAI or Anthropic directly. None of those paths goes through a DPU, and few of those agents were started inside a sandbox. OpenShell is open source and runs on other hardware, but it protects the agents you launch inside it, not the ones already running.
The principle survives that move. What changes is where it has to be enforced. On an ordinary machine the path to the model runs through the operating system the agent is running on, so that is where the watching has to happen.
You can see drift without reading the reasoning. NVIDIA also argues that the more an agent can do, the more its reasoning needs to be visible, and points out that open models expose their activations. For a model you host yourself, that holds. For a hosted frontier model the operator never sees the internals, and a store of everything an agent said is a record someone will one day have to protect, disclose or explain. Behavior is visible without any of it: which model an agent calls, which tools, which hosts, how often, in what order, and how that compares with the same agent last week. That is enough to see an agent stop behaving like itself.
Two layers, not one. NVIDIA pairs the behavioral watchdog with a gateway that verifies “each agent’s identity and delegated authority to ensure it operates within its assigned scope,” and describes that gateway as something that “complements this behavioral protection.” The ordering is right. One layer decides whether an agent may act. The other notices when an agent that is allowed to act stops behaving like itself. Neither replaces the other, and a design with only one of them has a gap exactly where the other would sit.
The useful question from all of this isn’t whether you have NVIDIA’s hardware. It is whether anything watches the path between your agents and their models on the machines they actually run on, and whether it would notice the one that stays inside its permissions and still changes.
Source: NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring, NVIDIA Technical Blog, 28 September 2026. What AariaSec covers, and what it leaves to others: the coverage map.