Red Hat and Nvidia add hardware-level security for autonomous AI agents

On 21 October, at Nvidia's GTC Berlin event, Red Hat announced a broader collaboration with Nvidia under its Red Hat AI Factory with Nvidia banner. It covers three things: securing the runtime of autonomous agents, governing access to models, and supporting Nvidia's Vera Rubin hardware. The same day Nvidia published its OpenShell Reference Architecture, a full-stack design for building, containing, observing and enforcing safe agents across enterprise infrastructure and edge systems, which it says is available now.

The security pitch rests on the idea that an agent should not be left to police itself. Two risks are named: an agent stepping outside the boundaries it was given, and attackers taking one over through prompt injection or a compromised software supply chain. The answer is to put controls outside the agent and, where it makes sense, outside the host operating system as well. Nvidia's John Fanelli put it plainly in a statement, saying those limits belong in the runtime and infrastructure beneath the agent.

“With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField”

Jensen Huang, founder and CEO, Nvidia, in Nvidia's announcement, as reported by Unite.AI · unite.ai ↗

OpenShell is the open-source sandbox runtime in the middle of this. Nvidia describes four parts: a Gateway that manages sandbox lifecycles and policies, a Supervisor that checks outbound requests against policy and handles credentials from outside the sandbox, the Sandbox itself, which restricts file and process access, and a Policy Prover that uses formal verification to test whether a policy's permissions stay under a ceiling set by the organisation. Workloads are treated as untrusted throughout and given access only when they need it.

Beneath it sits Nvidia's Sentry framework, running on BlueField data processing units. Agents run on Vera CPUs while the BlueField card sits on the node's only path to the model, so Sentry can inspect agent-to-model traffic without relying on the agent to report on itself. A component called DOCA Argus reads selected regions of host memory to follow processes, files, network connections and loaded libraries without any monitoring software on the host. Warning signs include unapproved tools, one process attacking another, heavy outbound traffic and mass file deletion. Alerts can trigger BlueField policies that cut a workload off, and Red Hat and Nvidia both say a compromised agent can be quarantined within milliseconds. Nvidia plans Sentry's availability for early next year, while some DOCA libraries, including Argus, are available now for experiments.

The two accounts name different hardware. Red Hat's side builds on the BlueField-3 support already in OpenShift 4.22, while Nvidia's own material names BlueField-4 for Sentry. Red Hat is also working to make OpenShell a native feature of its AI platforms, and that integration is not finished.

On the model side, the companies describe a joint reference design for Model-as-a-Service access. It combines an AI Gateway with the vLLM and llm-d inference engines, Nvidia Dynamo and NIM, and draws on Nvidia's Inference Hub design. The aim is self-service model discovery, with access policies, rate limits and tracking of who is entitled to what. They also announced joint support for Nvidia's Nemotron models, including Nemotron 3.5 Super VL, in vLLM and Red Hat AI Factory, with quantization and speculative decoding used to cut latency while keeping accuracy.

For hardware, RHEL for Nvidia now supports Vera CPUs and is being prepared for Vera Rubin, with compatibility targeted for when the systems arrive. Version 26.03 changes only a limited set of core packages and keeps the standard RHEL userspace and SELinux, so users can move to mainline RHEL without reinstalling once the patches reach the upstream kernel. It is offered through partners including Cisco, Dell Technologies and Lenovo. Nvidia claims the Vera Rubin NVL72 delivers 30 times the throughput per megawatt for agentic workloads and that Vera CPUs double x86 performance; these are the vendor's figures.

The announcement builds on May's Red Hat Summit, where Red Hat said its AI Factory already supported OpenShell, that confidential containers had reached tech preview and that RHEL for Nvidia 26.01 was generally available for Blackwell. Nvidia's Jensen Huang framed the latest work as building safety into the computing architecture itself as companies prepare to run billions of agents.