# NVIDIA OpenShell: A Reference Architecture for Safe Agents

> NVIDIA's OpenShell Reference Architecture for safe AI agents: the three layers, the open runtime and the partners, from GTC Berlin.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-21
- Canonical (HTML): https://cellcog.ai/blog/nvidia-openshell-reference-architecture/
- Section: Insights / Multi-agent & AI organizations
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- NVIDIA launched the OpenShell Reference Architecture at GTC Berlin on October 21, 2026: a full-stack design for running AI agents inside enforced boundaries, available now.
- Agents think on Vera Rubin, act on Vera CPUs running the open OpenShell runtime, and are watched by NVIDIA Sentry on BlueField-4 DPUs, which NVIDIA says quarantines a stray agent in milliseconds.
- OpenShell itself is open source under Apache 2.0: a kernel-level sandbox where agents never see real credentials and risky policy changes wait for human review.
- NVIDIA lists Anthropic, OpenAI, Meta, Google, Perplexity and SpaceX Super Intelligence among model builders whose agents enterprises can run on OpenShell infrastructure.
- ServiceNow made its Arc agent generally available the same day, with actions enforced by OpenShell; banks BBVA and Santander are exploring the architecture.

## At a glance

- **What is it?** A blueprint for where enterprise agents run: models on Rubin GPUs, agent harnesses and tools on Vera CPUs inside OpenShell sandboxes, and a hardware watchdog on BlueField DPUs.
- **What is actually open?** The OpenShell runtime, on GitHub under Apache 2.0 (version 0.1.5, October 20). The Rubin, Vera and BlueField hardware and the Sentry framework are NVIDIA products.
- **Who is it for?** Enterprises and cloud providers deploying many agents that touch real files, networks and credentials, who want each agent's access declared and enforced.

**NVIDIA launched the OpenShell Reference Architecture at GTC Berlin on October 21, 2026: a blueprint for running AI agents that can touch real files, networks and credentials, but only inside boundaries the hardware and software both enforce.** Jensen Huang's line for it: "agents can think on Rubin, act on Vera and be governed on BlueField." NVIDIA says the architecture is available now.

NVIDIA [announced it on X](https://x.com/nvidia/status/2112847277282721888) at 10:03 UTC during the keynote. This page reads the [press release](https://nvidianews.nvidia.com/news/openshell-reference-architecture), NVIDIA's [keynote live blog](https://blogs.nvidia.com/blog/gtc-berlin-2026-keynote/) and the open-source [OpenShell repository](https://github.com/NVIDIA/OpenShell).

## Why Huang made security the headline

On stage Huang described an agent as five parts: a model, a harness that orchestrates its work and memory, a sandbox that isolates the harness, knowledge and tools. Because an agent can reach files, networks and tools, its privileges should be minimal and it should be monitored. "The most important thing is to make sure the agent is secure," he said, adding that privileges have to change per task: "Every single time an agent is launched, the privileges are different."

## The three layers

*Table: OpenShell Reference Architecture, layer by layer (NVIDIA press release, October 21, 2026)*

| Layer | Hardware or software | Job | NVIDIA's claim |
|---|---|---|---|
| Think | Vera Rubin NVL72 | Model inference, closed and open models | 30x higher throughput per megawatt for agentic work |
| Act | Vera CPUs + OpenShell runtime | Agent harnesses and tool use, sandboxed | 2x the performance of x86 processors |
| Govern | BlueField-4 DPUs + NVIDIA Sentry | Out-of-band monitoring, in-silicon enforcement | Quarantines a stray agent in milliseconds; up to 20% more agent capacity |
| Edge | RTX Spark, DGX Spark, DGX Station | The same design on local machines | Retail, healthcare, robotics, software development |

The governing layer is the new part. If an agent tries to move outside its software boundary, Sentry "quarantines and stops it in milliseconds," according to the release, from a DPU the agent's own software cannot reach.

![Animation: three layers labelled Rubin think, Vera act and BlueField govern; an agent box sits in a sandbox on the Vera layer, an amber arrow from it stops at the sandbox wall as a watchdog on the BlueField layer turns amber, and the agent box turns dashed, labelled quarantined in milliseconds](https://cellcog.ai/blog/media/nvidia-openshell-reference-architecture/os-three-layers.svg)
*The model thinks on Rubin, the agent acts on Vera, BlueField stops it at the wall*

## What OpenShell itself does

The runtime underneath has been public since February 2026 and is Apache 2.0 licensed; v0.1.5 shipped on October 20. Its README states the idea in one sentence: "You declare what each agent can touch in a policy, and OpenShell enforces it."

- **Kernel-level sandbox.** Each agent's files and system calls are confined by kernel controls, and every network connection passes a policy check before it leaves.
- **Credentials stay out of reach.** "Agents never see real credentials"; OpenShell adds them only to requests bound for approved endpoints.
- **Policy changes get checked first.** OpenShell uses formal verification to flag new access a policy change would grant, such as reaching a new host with credentials, so those changes wait for human review.

![Animation: an agent in a sandbox sends two requests through a policy check; the first picks up an amber key at the gate and reaches the approved endpoint, the second is stopped and drops into human review, which gets an amber outline](https://cellcog.ai/blog/media/nvidia-openshell-reference-architecture/os-credentials.svg)
*The gate adds the key for approved endpoints; new hosts wait for review*

*Table: NVIDIA's open agent runtime repos on GitHub (read October 21, 2026)*

| Repo | What it is | Stars |
|---|---|---|
| NVIDIA/NemoClaw | Runs agents such as Hermes, LangChain Deep Agents and OpenClaw inside OpenShell | 22,787 |
| NVIDIA/OpenShell | The runtime | 16,878 |
| NVIDIA/OpenShell-Community | Community repo | 193 |

## Who signed on

The list is long, which is the point of a reference architecture:

- **Model builders:** enterprises can run agents from Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection and SpaceX Super Intelligence on OpenShell infrastructure.
- **Security vendors:** 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI and Zscaler are integrating support.
- **Operating systems and clouds:** Canonical, SUSE, Red Hat and Microsoft Windows via Microsoft Execution Containers; AWS, Google Cloud and Azure.
- **Software:** SAP is wiring it into Joule Studio; ServiceNow made its Arc agent generally available the same day, with actions enforced by OpenShell.
- **Banks:** BBVA and Santander are exploring it as a framework for agent governance.

## Also at the keynote

Huang announced DSX POD, containerized Vera Rubin AI factories built and validated before delivery, which NVIDIA says cut onsite deployment from six months to 14 days. NVIDIA also published an open-models roundup; our [Nemotron 3.5 post](https://cellcog.ai/blog/nemotron-3-5-super-vl-bolt/) now carries its new paid prices.

## What it means for teams running agents

The direction is now industry-wide: an agent that does real work gets its own contained computer, explicit permissions and a watchdog outside its reach. [Daytona](https://cellcog.ai/blog/daytona-series-b-agent-cloud/) raised $60M on the same idea a day earlier. CellCog builds the same principle into every AI employee: each runs on its own secure VM and file system, and every command that reaches your world is classified, with anything unclassified rejected before it runs.

## What to watch

- Independent tests of Sentry's quarantine claim and its effect on agent throughput.
- Whether Anthropic, OpenAI or Meta document their own agents running on OpenShell, beyond the partner list.
- OpenShell's release pace after 0.1.x and how fast NemoClaw follows.

## FAQ

**What is the NVIDIA OpenShell Reference Architecture?**

A full-stack design NVIDIA announced at GTC Berlin on October 21, 2026 for building, containing, observing and enforcing safe AI agents, combining Vera Rubin, Vera CPUs, the OpenShell runtime and BlueField-4 DPUs running NVIDIA Sentry.

**Is OpenShell open source?**

Yes. The OpenShell runtime is on GitHub at NVIDIA/OpenShell under the Apache 2.0 license; the latest release was v0.1.5 on October 20, 2026.

**How does OpenShell keep an agent contained?**

Each agent runs in an isolated sandbox. Kernel controls limit its files and system calls, every network connection passes a policy check, credentials are added only to requests bound for approved endpoints, and risky policy changes are flagged for human review.

**What does NVIDIA Sentry do?**

Sentry runs on BlueField-4 DPUs and monitors agent behavior out of band. NVIDIA says it quarantines and stops an agent in milliseconds if it tries to move outside its software boundary.

**Does CellCog run on OpenShell?**

No. Each CellCog AI employee runs on its own secure VM and file system with its own browser identity. The agent classifies every command that reaches your world, and the platform rejects any command that arrives unclassified.

## Related

- [Daytona Raises $60M at $1B to Give Every Agent a Computer](https://cellcog.ai/blog/daytona-series-b-agent-cloud/index.md)
- [Perplexity SPACE: The Open-Source Agent Sandbox, Tested](https://cellcog.ai/blog/perplexity-space-sandbox/index.md)
- [OpenClaw Enterprise: The Open Agent Control Plane](https://cellcog.ai/blog/openclaw-enterprise/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/nvidia-openshell-reference-architecture/. Try CellCog free, no credit card needed: https://cellcog.ai/signup