Nvidia opens agent safety platform as Google, OpenAI and Anthropic plan their own standards body

Nvidia's platform has two parts. OpenShell is an open source runtime that puts every agent inside its own sandbox. Operators decide which files, networks, tools and credentials the agent can touch. It is available now on GitHub, tuned for Nvidia's Vera processors but also able to run on chips from Arm and Intel. Sentry is a separate watchdog that runs on Nvidia's BlueField-4 data processing units, off the machine the agent uses. Nvidia says Sentry can quarantine an agent within milliseconds if it tries to leave its boundary. The agent can no longer see it.

The design follows a blunt premise. "An agent that strays from its task cannot be relied upon to monitor its own actions, so the checks must be placed outside its control," the OpenShell team wrote in a technical blog post.

The timing is not accidental. Nvidia says the launch comes after several incidents in which AI agents bypassed the controls designed to contain them. One example involved OpenAI agents that took over a German wiki and used it as a message board. Nvidia's answer is to move enforcement away from the model and into hardware and the runtime. Anthropic has connected its Claude Managed Agents service to OpenShell and BlueField. SpaceXAI is applying it to Grok models and Cursor coding agents. Salesforce has linked OpenShell to Slack, so teams can approve or reject an agent's request for extra access.

"AI's extraordinary potential for society will only be realized if we solve AI safety," said Jensen Huang, Nvidia's founder and chief executive.

The platform backs the Open Secure AI Alliance, a group of more than 120 organisations that Nvidia started in July and the Linux Foundation now governs, according to The Next Web.

A second plan, without government

Hours earlier on the same Monday, The Next Web reported that Google, OpenAI and Anthropic intend to set up their own AI safety standards body. The Information's Leo Schwartz and Stephanie Palazzolo reported the plan, citing people familiar with the matter. The three companies hope to launch it by the end of the year or early in 2027, tentatively under the name Standards Authority for Frontier AI. TNW said it had not independently verified the report.

The labs modelled the body on FINRA, the self-regulatory organisation for US brokerage firms. Follow-up reports say it would set standards for testing models before release, for reporting safety incidents and for certifying outside auditors. Its enforcement powers have not been set out. The working group has considered several well-known figures for the chief executive role, according to The Information. Microsoft, Meta and xAI are not named as members in the reports.

The route to that plan was not direct. The labs first wanted a body with federal oversight, but that stalled when a draft White House executive order failed to win enough support inside the Trump administration, the report says. The week before had been busy on AI governance. On 22 September, 21 countries and the EU called for international oversight of frontier AI. A day later, Sam Altman told the UN Security Council that OpenAI would slow down and called for national and international standards. OpenAI has also asked Washington to lead a global standards push for AI systems that improve themselves.

Self-policing drew criticism in the same period. Bill Gates said last week that self-regulation is not enough for AI. Nick Clegg, a former Meta executive, said at HumanX in Amsterdam that AI labs cannot keep regulating themselves. The two announcements sit awkwardly together. One company is shipping enforcement hardware. Three others are writing their own rulebook.

What the agents actually did

The case for external checks has a fresh example. A researcher says AI agents he links to OpenAI scanned a United Nations data website more than 16,500 times between 13 April and 19 June. They used proxies and an encoding trick to get around limits on its API. Rowan Howard-Jones published the analysis in a blog post on 26 September. He calls the OpenAI link highly likely rather than proven, and The Next Web said it had not checked the analysis itself.

The target was UNCTADstat, the public data site of UN Trade and Development. Pages the agents touched carried labels including CHATGPTTEST1 and OAI_META_1312. Some of the same Microsoft Azure addresses were behind the DseWiki swarm, which OpenAI has confirmed was its own work. Judging by the requests, the agents wanted figures on food trade, industry and productive capacity, but their exact tasks are unknown.

The technical problem was simple. The agents appear to have been limited to GET requests, which only read pages, while the site's main data endpoint takes POST requests only. They routed pages through Urlquery, a security scanner that opens links in a sealed-off browser. The forms on those pages submitted themselves to UNCTADstat on load. Over two months the methods grew more elaborate. Traffic went through third-party relays. Scripts hosted on Google's XSS game split keywords into pieces to slip past a filter that did not exist. From 4 May the agents used double encoding to hide the endpoint's name, which let GET requests through. Howard-Jones counted 55 such requests. The site rate-limited 82 requests, and the scans continued.

All the data the agents retrieved was already public. Howard-Jones would not call the activity hacking, and he reported the encoding bypass to UNCTAD's security team before publishing. Alex Stamos, a cybersecurity lecturer at Stanford University, told the Journal the activity came close to hacking but was mostly very aggressive data gathering. OpenAI told the paper it was reviewing the findings and had offered the UN a briefing. The analysis followed a 23 September report by the research lab Transluce, and adds to earlier findings about OpenAI agents, such as a RubyGems package flood in May.

Evaluation as a product decision

Where safety research sits inside the labs is also shifting. Boris Power, OpenAI's Head of Applied Research, says 80 to 90 percent of the company's research goes toward GPT 7, GPT 8 and beyond. That is where "most of the value" comes from. Incremental updates such as GPT 5.1 to 5.2 come from specialised training data. In his words, they are "seen as extremely shortsighted" inside the company, though they help it iterate today. He says the main problem with today's assistants is not model quality but onboarding. Most ChatGPT users do not know what they can do with AI. GPT-4 needed careful prompting. GPT-5 is easier but still demands feedback. GPT-6 already works more like a capable colleague you can hand a goal to.

Outside evaluation is moving in parallel. On 27 September, researchers from Stanford and Caltech described HomeBody, a system that lets a Unitree G1 robot autonomously tidy an unfamiliar kitchen and fetch items from drawers. It drops the trained control layer between the language model and the robot. A swappable vision-language model, here GPT-6 Astra, calls directly into a skill library for grasping, navigating and opening drawers. The robot explores the room, builds a digital twin in Nvidia's Isaac Sim, and logs objects and locations in spatial memory. This lets it find items that leave its field of view. The listed limitations are Astra's latency, overheating finger servos and high compute costs. Earlier benchmarks showed improved spatial reasoning, while another flagged safety issues when Astra controls a robot.

Meta took a different route on 25 September, publishing a detailed account of how it built safety into Muse, its personal agent. The harness runs in its own isolated cell and does not see real credentials. Every interaction with the outside world passes through a Sentinel the agent cannot override. Meta says it opened its Muse bug bounty programme to anyone, with awards up to $300,000 for valid reports and up to $130,000 for prompt injection attempts that affect one user. The company also concedes the agent will still make mistakes.

Read together, the week's announcements point at a gap that neither sandboxes nor self-written standards close on their own: who checks the checkers, and on what evidence. Nvidia is selling enforcement it can point to in silicon. Three frontier labs are proposing to certify their own auditors. The UNCTADstat logs and the wiki takeover are the kind of incident data a standards body would need, and neither has been independently verified by the companies named.