Skip to content
Hire an AI employee
AI EmployeeSuper-AgentsAgent-to-AgentBenchmarksPricingBlog
Insights 04 Multi-agent & AI organizations

NVIDIA OpenShell: A Reference Architecture for Safe Agents

Nitish Garg · Founder & CEO, CellCog · 21 October 2026 · 5 min read · 1,088 words
At a glanceQuick answers
What is it?
A blueprint for where enterprise agents run: models on Rubin GPUs, agent harnesses and tools on Vera CPUs inside OpenShell sandboxes, and a hardware watchdog on BlueField DPUs.
What is actually open?
The OpenShell runtime, on GitHub under Apache 2.0 (version 0.1.5, October 20). The Rubin, Vera and BlueField hardware and the Sentry framework are NVIDIA products.
Who is it for?
Enterprises and cloud providers deploying many agents that touch real files, networks and credentials, who want each agent’s access declared and enforced.
Data illustration on a near-white ground: a small teal robot agent works at a laptop inside a glass box whose wall stops an amber arrow, standing on three layers labelled Rubin think, Vera act and BlueField govern, beside the large word OpenShell
Fig 0Think on Rubin, act on Vera, governed on BlueField. Made by CellCog's image agent, running GPT Image 2.5.

NVIDIA launched the OpenShell Reference Architecture at GTC Berlin on October 21, 2026: a blueprint for running AI agents that can touch real files, networks and credentials, but only inside boundaries the hardware and software both enforce. Jensen Huang’s line for it: “agents can think on Rubin, act on Vera and be governed on BlueField.” NVIDIA says the architecture is available now.

NVIDIA announced it on X at 10:03 UTC during the keynote. This page reads the press release, NVIDIA’s keynote live blog and the open-source OpenShell repository.

On this page · 7 sectionsOpen
  1. Why Huang made security the headline
  2. The three layers
  3. What OpenShell itself does
  4. Who signed on
  5. Also at the keynote
  6. What it means for teams running agents
  7. What to watch
Key points5 · 5 min full read
  1. Three stacked slabs like a foundation.
    NVIDIA launched the OpenShell Reference Architecture at GTC Berlin on October 21, 2026: a full-stack design for running AI agents inside enforced boundaries, available now.
  2. A hand stopping an arrow at the edge of a box.
    Agents think on Vera Rubin, act on Vera CPUs running the open OpenShell runtime, and are watched by NVIDIA Sentry on BlueField-4 DPUs, which NVIDIA says quarantines a stray agent in milliseconds.
  3. A key in an envelope travelling to a door.
    OpenShell itself is open source under Apache 2.0: a kernel-level sandbox where agents never see real credentials and risky policy changes wait for human review.
  4. Six squares linked to one central circle.
    NVIDIA lists Anthropic, OpenAI, Meta, Google, Perplexity and SpaceX Super Intelligence among model builders whose agents enterprises can run on OpenShell infrastructure.
  5. An open padlock beside a code symbol.
    ServiceNow made its Arc agent generally available the same day, with actions enforced by OpenShell; banks BBVA and Santander are exploring the architecture.

§ 01Why Huang made security the headline

On stage Huang described an agent as five parts: a model, a harness that orchestrates its work and memory, a sandbox that isolates the harness, knowledge and tools. Because an agent can reach files, networks and tools, its privileges should be minimal and it should be monitored. “The most important thing is to make sure the agent is secure,” he said, adding that privileges have to change per task: “Every single time an agent is launched, the privileges are different.”

§ 02The three layers

Layer Hardware or software Job NVIDIA’s claim
Think Vera Rubin NVL72 Model inference, closed and open models 30x higher throughput per megawatt for agentic work
Act Vera CPUs + OpenShell runtime Agent harnesses and tool use, sandboxed 2x the performance of x86 processors
Govern BlueField-4 DPUs + NVIDIA Sentry Out-of-band monitoring, in-silicon enforcement Quarantines a stray agent in milliseconds; up to 20% more agent capacity
Edge RTX Spark, DGX Spark, DGX Station The same design on local machines Retail, healthcare, robotics, software development
Table 1OpenShell Reference Architecture, layer by layer (NVIDIA press release, October 21, 2026)

The governing layer is the new part. If an agent tries to move outside its software boundary, Sentry “quarantines and stops it in milliseconds,” according to the release, from a DPU the agent’s own software cannot reach.

Animation: three layers labelled Rubin think, Vera act and BlueField govern; an agent box sits in a sandbox on the Vera layer, an amber arrow from it stops at the sandbox wall as a watchdog on the BlueField layer turns amber, and the agent box turns dashed, labelled quarantined in milliseconds
Fig 1The model thinks on Rubin, the agent acts on Vera, BlueField stops it at the wall

§ 03What OpenShell itself does

The runtime underneath has been public since February 2026 and is Apache 2.0 licensed; v0.1.5 shipped on October 20. Its README states the idea in one sentence: “You declare what each agent can touch in a policy, and OpenShell enforces it.”

  • Kernel-level sandbox. Each agent’s files and system calls are confined by kernel controls, and every network connection passes a policy check before it leaves.
  • Credentials stay out of reach. “Agents never see real credentials”; OpenShell adds them only to requests bound for approved endpoints.
  • Policy changes get checked first. OpenShell uses formal verification to flag new access a policy change would grant, such as reaching a new host with credentials, so those changes wait for human review.
Animation: an agent in a sandbox sends two requests through a policy check; the first picks up an amber key at the gate and reaches the approved endpoint, the second is stopped and drops into human review, which gets an amber outline
Fig 2The gate adds the key for approved endpoints; new hosts wait for review
Repo What it is Stars
NVIDIA/NemoClaw Runs agents such as Hermes, LangChain Deep Agents and OpenClaw inside OpenShell 22,787
NVIDIA/OpenShell The runtime 16,878
NVIDIA/OpenShell-Community Community repo 193
Table 2NVIDIA’s open agent runtime repos on GitHub (read October 21, 2026)
GitHub stars on NVIDIA's agent runtime repos, read October 21, 2026Bar chart: NemoClaw 22,787 stars, OpenShell 16,878, OpenShell-Community 193, with OpenShell highlightedNemoClaw22787OpenShell16878OpenShell-Community193GitHub stars on NVIDIA's agent runtime repos, read October 21, 2026Bar chart: NemoClaw 22,787 stars, OpenShell 16,878, OpenShell-Community 193, with OpenShell highlightedNemoClaw22787OpenShell16878OpenShell-Community193
Fig 3GitHub stars on NVIDIA's agent runtime repos, read October 21, 2026

§ 04Who signed on

The list is long, which is the point of a reference architecture:

  • Model builders: enterprises can run agents from Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection and SpaceX Super Intelligence on OpenShell infrastructure.
  • Security vendors: 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI and Zscaler are integrating support.
  • Operating systems and clouds: Canonical, SUSE, Red Hat and Microsoft Windows via Microsoft Execution Containers; AWS, Google Cloud and Azure.
  • Software: SAP is wiring it into Joule Studio; ServiceNow made its Arc agent generally available the same day, with actions enforced by OpenShell.
  • Banks: BBVA and Santander are exploring it as a framework for agent governance.

§ 05Also at the keynote

Huang announced DSX POD, containerized Vera Rubin AI factories built and validated before delivery, which NVIDIA says cut onsite deployment from six months to 14 days. NVIDIA also published an open-models roundup; our Nemotron 3.5 post now carries its new paid prices.

§ 06What it means for teams running agents

The direction is now industry-wide: an agent that does real work gets its own contained computer, explicit permissions and a watchdog outside its reach. Daytona raised $60M on the same idea a day earlier. CellCog builds the same principle into every AI employee: each runs on its own secure VM and file system, and every command that reaches your world is classified, with anything unclassified rejected before it runs.

§ 07What to watch

  • Independent tests of Sentry’s quarantine claim and its effect on agent throughput.
  • Whether Anthropic, OpenAI or Meta document their own agents running on OpenShell, beyond the partner list.
  • OpenShell’s release pace after 0.1.x and how fast NemoClaw follows.
Frequently asked5 questions

Q1What is the NVIDIA OpenShell Reference Architecture?

A full-stack design NVIDIA announced at GTC Berlin on October 21, 2026 for building, containing, observing and enforcing safe AI agents, combining Vera Rubin, Vera CPUs, the OpenShell runtime and BlueField-4 DPUs running NVIDIA Sentry.

Q2Is OpenShell open source?

Yes. The OpenShell runtime is on GitHub at NVIDIA/OpenShell under the Apache 2.0 license; the latest release was v0.1.5 on October 20, 2026.

Q3How does OpenShell keep an agent contained?

Each agent runs in an isolated sandbox. Kernel controls limit its files and system calls, every network connection passes a policy check, credentials are added only to requests bound for approved endpoints, and risky policy changes are flagged for human review.

Q4What does NVIDIA Sentry do?

Sentry runs on BlueField-4 DPUs and monitors agent behavior out of band. NVIDIA says it quarantines and stops an agent in milliseconds if it tries to move outside its software boundary.

Q5Does CellCog run on OpenShell?

No. Each CellCog AI employee runs on its own secure VM and file system with its own browser identity. The agent classifies every command that reaches your world, and the platform rejects any command that arrives unclassified.

Published 21 October 2026 All Multi-agent & AI organizations →