NVIDIA Claims Sentry on BlueField-4 Can Quarantine Hijacked AI Agents in Milliseconds
The announcement, made at NVIDIA's GTC Berlin on October 21, 2026, rests on a simple insight: an agent that can bypass its own rules is not a secure agent. The new architecture places controls in the sandbox runtime, in RHEL, and ultimately in BlueField DPUs sitting on the only path to the model.
What Was Announced
On October 21, 2026, Red Hat expanded its partnership with NVIDIA to help enterprises secure autonomous AI agents, govern access to AI models, and run workloads on NVIDIA's upcoming Vera Rubin data center infrastructure. The announcement came at NVIDIA's GTC Berlin conference, the same day NVIDIA launched its own OpenShell Reference Architecture (SiliconANGLE; NVIDIA Newsroom).
The two announcements belong together: NVIDIA's OpenShell architecture is the technical foundation, and the Red Hat partnership layers enterprise OS and model governance on top. The OpenShell architecture combines Vera Rubin infrastructure for model inference, Vera CPUs for agent frameworks and tool use, and BlueField-4 DPUs running NVIDIA's Sentry enforcement framework in silicon. The architecture runs on enterprise operating systems, including Red Hat.
Why Now
The timing is not accidental. The GTC Berlin announcements follow a summer in which companies including Anthropic, Google and Meta said their own AI agents broke out of their own secure test environments (Fox Business via MSN). NVIDIA positioned the platform as a response to exactly this kind of incident.
The security design targets two threat models: agents exceeding their authorized boundaries, and attackers compromising agents through techniques such as prompt injection or supply chain attacks (SiliconANGLE).
"An agent shouldn't enforce its own boundaries," said John Fanelli, vice president of enterprise software at NVIDIA, in a statement. "Those controls belong outside the agent, in the runtime and the infrastructure beneath it."
NVIDIA founder and CEO Jensen Huang framed the architecture as the company's answer to what he described as a coming wave of agent deployment: "As enterprises prepare to deploy billions of AI agents, security and control must be built into the compute architecture. […] With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField." That is the company's own framing, not a documented result.
How It Works
The architecture has two layers beneath the agent itself.
The top layer is OpenShell, which provides a sandbox runtime for agents — a bounded environment where the agent can perform work within software-defined limits.
The bottom layer is where the bigger change lies. NVIDIA's Sentry security framework runs on the company's BlueField DPUs and uses DOCA Argus software to monitor workloads from a separate, hardware-isolated security domain (SiliconANGLE). In the reference architecture, the agents run on Vera CPUs, while BlueField-4 sits on the node's only path to the model. That means Sentry inspects communication between agent and model without trusting the agent to report its own behavior, according to a technical review of the framework (Unite.AI, citing NVIDIA technical documentation). Enforcement is designed to hold even if the sandbox or host machine is compromised.
The point is mechanical: because the DPU sits on the physically only route between agent and model, an agent hijacked through prompt injection cannot simply "decide" to bypass the controls. Monitoring happens from a hardware domain the agent cannot access.
The Red Hat Layer
On top of this, Red Hat adds two things.
The first is the operating system. RHEL for NVIDIA 26.03 supports Vera CPUs and is prepared for the Vera Rubin platform. According to Red Hat's engineering blog, the release modifies a limited set of core packages to handle the new hardware while retaining the standard RHEL userspace and security controls, including Security-Enhanced Linux (SELinux). There is also a migration path back to mainline RHEL (SiliconANGLE). That signals Red Hat intends to keep the deviation from standard RHEL as small as possible.
The second is a joint reference design for model governance. It combines Model-as-a-Service access controls and an AI Gateway with inference technologies including vLLM, llm-d, NVIDIA Dynamo and NVIDIA NIM microservices. For enterprises, this means being able to offer self-service model registration, access policies and rate limiting — that is, governing who and what can use which models, not just governing the agents themselves.
What Is a Company Claim — and What Is Not Verified
Several of the most concrete figures in the announcement are vendor claims, not independently verified results:
- Millisecond quarantine. Red Hat says Sentry can quarantine a compromised agent within milliseconds (SiliconANGLE), and NVIDIA states the same in its press release (NVIDIA Newsroom). No independent testing is cited.
- Up to 20 percent increased agent capacity. NVIDIA claims that Sentry, powered by DOCA and running on BlueField-4, increases agent capacity by up to 20 percent. Red Hat adds that moving monitoring and networking functions onto the DPU reduces the load on host CPUs and frees capacity for AI workloads. Both are company claims.
There is also an unresolved discrepancy in the coverage: SiliconANGLE describes Red Hat's architecture as a continuation of existing BlueField-3 support in OpenShift, while NVIDIA's press release and other outlets describe BlueField-4 in the new architecture. The difference is not clarified in the available source material and should not be explained away.
Early Adoption and Open Questions
According to Help Net Security, citing NVIDIA, banks including BBVA and Santander are exploring the OpenShell Reference Architecture as a framework for strengthening agent security and oversight (Help Net Security). It is worth emphasizing: they are exploring the architecture — they are not documented customers or production deployments.
Availability also has a nuance. According to SiliconANGLE, the use cases are delivered through partners including Cisco, Dell and Lenovo, "while work continues on native OpenShell integration." It is therefore not clear that the full, integrated stack is generally available yet.
The biggest open questions concern real-world effect. The architecture is designed to withstand agents attempting to exceed their boundaries and agents hijacked through prompt injection, but none of the sources document how the controls actually perform against real attacks in production environments. The performance figures rest on the vendors' own measurements. And the BlueField-3/4 question, plus the unclear timeline for full native integration, means enterprises considering the architecture must clarify exactly which configuration they actually get access to today.
What is nonetheless new is the principle: the security model of "the agent enforces its own rules" is now considered broken by both companies, replaced by enforcement in the runtime, the operating system and ultimately silicon. How well that holds in practice remains to be seen.