NVIDIA has published its position on securing AI agents, framing the problem as an engineering discipline rather than a modelling one. The company argues that every agent deployment needs enforceable boundaries, a named owner and evidence that protections work. The core claim is that security responsibilities established for the internet and cloud computing — establish identity, control access, limit exposure, verify protections — carry over unchanged to agents that reason, use tools and adapt their actions to the data they encounter.
What NVIDIA proposes for the agent stack
The stack is described in three parts: models supply capabilities, harnesses organise context, tools and workflows, and runtime environments provide the infrastructure where actions execute. Each layer carries its own security responsibilities, and protection requires controls across all of them because data, instructions and actions move through the system. NVIDIA's own contribution is OpenShell, an open source secure runtime that enforces policies outside the agent's reach and provides sandboxed execution while governing access to data, network and system resources. Partners in the Open Secure AI Alliance are building on it: Cisco's DefenseClaw adds a governance layer, and JFrog integrates with OpenShell to scan and verify agent skills and to enforce policies on which skills an agent may access.
The mechanics rest on separating permission from reasoning. An agent updating a customer record should not automatically be able to export that data; it can request additional access, but it cannot authorise that access itself. The runtime environment, not the agent's own judgement, sets limits on files, network destinations and processes. NVIDIA illustrates this with an agent that encounters malicious instructions in an attached document and attempts to send customer data to an unauthorised destination: a network policy should block the transfer, and protected logs should capture the attempted tool call, the authorisation decision and the outcome so investigators can identify the tool used and the destination it targeted. Each agent also needs a traceable identity and credentials limited to its assigned task, with consequential actions and permission changes still requiring human approval.
What this means for companies deploying agents
For businesses, the practical consequence is that agent security becomes a procurement and testing requirement rather than a feature of the model. Before deployment, teams need evidence that controls block attempts to obtain credentials beyond an agent's scope or to send sensitive data to an unauthorised destination, and testing should also cover attempts to change permissions or interfere with monitoring. NVIDIA states that such tests must be repeated after material changes to models, tools or workflows. A named owner has to use those results to decide whether the system is ready, and failures found in testing or operation should be reproduced, investigated and turned into repeatable tests. CrowdStrike's SafeMind and Palo Alto Networks Prisma AIRS are cited as examples of repeated attack simulation and continuous red teaming.
Smaller companies face a different trade-off from large ones. A small team is unlikely to run its own red teaming programme, so it depends on managed capabilities and services, which closed models provide. Open models give defenders the option to inspect relevant components, adapt strategies and work on infrastructure they control — during an incident that control helps a team reproduce a failure and test a fix against its own systems while keeping sensitive evidence inside its environment. The value of capable AI in this work, according to NVIDIA, should be assessed through reproducible findings, verifiable fixes and accelerated response time rather than through vendor claims. Capital One's VulnHunter and ReversingLabs' Spectra Assure are named as examples of AI-powered code security and analysis of software packages for malware and tampering.
Several questions remain open for buyers. The source does not specify which controls are mandatory, how compliance is certified, or what an audit trail must contain to satisfy a regulator, so those points need to be clarified with the vendor. It also does not follow from this announcement that any particular runtime makes an agent safe by itself: NVIDIA's own framing is that instructions and safeguards guide behaviour, while security requires enforceable boundaries independent of the agent's reasoning. Teams evaluating agent platforms should therefore ask where policies are enforced, who holds the credentials, what is logged and for how long, how access is revoked, and whether test results are reproducible on their own infrastructure.
The marker to watch is adoption of OpenShell and the Open Secure AI Alliance: if Cisco's DefenseClaw governance layer and JFrog's skill verification move from integration announcements to production deployments with published test evidence, layered agent security becomes a standard procurement item. If the alliance stays a research exchange without named owners and repeatable tests, most companies will keep treating agent security as a model-level setting — and will carry the operational risk that comes with it.
