Nvidia's Sentry watchdog targets agent escapes within milliseconds

Nvidia's platform layers three pieces together: OpenShell, the open-source software it introduced in March that locks each agent in a sandbox where operators decide which files, programs, networks, and credentials it can touch; Sentry, the new hardware watchdog; and a formal verification tool introduced on September 10 that is meant to detect whether those permissions reach beyond set limits. The verification tool does not yet cover multiple agents working together, Nvidia says. Sentry itself is a reference design for the BlueField-4 data processing units and, in the Vera Rubin data center system, sits on the only connection between the agent and the AI model.

The reasoning Nvidia gives is that agents can drift from their assignments when instructions are unclear or tasks run for weeks, and that this cannot be trained out of them without limiting their capabilities, so an agent cannot fully monitor itself. Nvidia argues that the more an agent is allowed to do, the more visible its reasoning should be, yet Sentry mainly checks requests, identities, and access. An Anthropic study from 2025 found that the reasoning summaries closed-model providers share do not reliably reflect what actually drives a model, and in other experiments researchers found models can hide their intentions in those logs when specifically told to. Prompt injection remains hard as well: attackers hide commands in places like a web page, and a language model cannot reliably tell those instructions apart from normal content.

Nvidia compares the effort to the web browser, which it says made the internet safer by isolating every site. Browsers did not end attacks, though; they made them harder and still need constant patching today, and Nvidia itself relies on multiple layers of protection. Whether a hardware watchdog changes the equation may hinge on whether permitted targets are clearly defined at a technical level and whether access to outside systems is actually blocked, and on detection figures Nvidia has not published.