What Nvidia actually announced
OpenShell is Nvidia's open-source secure runtime for autonomous agents. The reference architecture wraps that runtime in a hardware and infrastructure blueprint. According to Nvidia's announcement, it has four layers:
- Vera Rubin infrastructure runs the models, including open and closed models built with Nemotron.
- Vera CPUs run the agent harnesses and tool use, and they host OpenShell.
- OpenShell software provides the runtime boundary around each agent.
- BlueField-4 DPUs run Nvidia Sentry, which monitors agent behavior from outside the agent and enforces policy in hardware.
Nvidia says the design can extend to edge systems such as RTX Spark, DGX Spark and DGX Station. Coverage of the GTC Berlin announcement says it is available now. Nvidia's materials list no pricing or version number.
CEO Jensen Huang summed up the pitch in a line from the release: agents can think on Rubin, act on Vera and be governed on BlueField. The Register notes the catch. Implementing it as described means buying Nvidia hardware.
The software pieces, in plain English
Nvidia's technical blog says OpenShell has four components:
- Gateway: the control plane that manages sandbox lifecycles and policies.
- Supervisor: checks outbound requests against policy and mediates access to credentials. It runs separately from the sandbox.
- Sandbox: isolates the agent workload and restricts file and process access.
- Policy Prover: formally verifies that a policy's permissions stay within an organization-defined ceiling.
The design principle is that an agent shouldn't police itself. The blog's own wording is that governance belongs in the infrastructure around the agent. OpenShell also offers extension points. Supervisor middleware can inspect, block or alter network content. Gateway interceptors let operators add deployment-specific governance. Identity, authorization, data protection and auditing systems can plug into the enforcement points. OpenShell doesn't supply those enterprise controls by itself.
This sits above what agent tools already do. The Register notes that Claude Code, Codex, OpenClaw and OpenCode limit access to tools like curl and bash, and that developers often add sandboxes. OpenShell extends that to credentials, identity and policy boundaries, and eventually routing and workflows.
The hardware safeguard: Sentry on BlueField-4
Sentry is the optional extra layer. Nvidia's blog says BlueField-4 gives agents a hardware-isolated trust domain outside their reach. It sits in the I/O path between agents on Vera and the models they call. Sentry watches requests, responses, network and file activity, and verifies identity and delegated authority. It also analyzes selected host memory, all without relying on the agent to report on itself.
Nvidia says Sentry can quarantine an agent within milliseconds of a policy violation. The blog calls this an optional safeguard, not a requirement for every deployment. The "milliseconds" claim comes with no test methodology or threat model in the material. Treat it as a vendor description of intended behavior, not independent validation.
Where Windows and Microsoft fit
Nvidia's announcement says the architecture runs on Linux and Kubernetes infrastructure powered by Canonical, SUSE and Red Hat, as well as Microsoft Windows using Microsoft Execution Containers (MXC). It also says it can run on cloud operating systems from AWS, Google Cloud and Azure. Microsoft is listed among the cybersecurity companies integrating support into their agent security products.
These are three separate claims:
- Windows with MXC is an OS option.
- Azure is a cloud option.
- Microsoft is working on security-solution integration.
The announcement gives no Windows edition, minimum build or MXC release. It gives no deployment instructions either, so nobody should assume specifics.
A public engineering thread gives some background on the Windows work. A GitHub issue in the OpenShell repository proposes native Windows support through a new compute driver, openshell-driver-mxc, using MXC via wxc-exec.exe as the sandbox primitive. It says OpenShell doesn't need to port its Linux in-sandbox supervisor to Windows. Instead, egress policy enforcement moves to the host. The proposed design has the gateway running as a long-lived Windows Service. That is a design proposal from roughly 113 days before this article, not a statement of shipped behavior. It does show the Windows path is meant to work differently from the Linux one.
There is also a mismatch to watch. Nvidia's README for the standalone OpenShell project lists Windows with WSL 2 as experimental, alongside Linux and Apple-silicon macOS. The reference architecture lists Windows with MXC. The sources don't explain how the two relate, or whether they have the same capabilities and support status. Anyone planning a Windows pilot should check Nvidia's current support matrix and documentation first.
Partners: announced work versus finished work
The partner list is long, and the wording matters. Nvidia says cybersecurity vendors including 1Password, Check Point, CrowdStrike, Cisco, F5, Fortinet, Microsoft, Okta, Palo Alto Networks, TrendAI and Zscaler are integrating support for the architecture into their agent security products. "Integrating" doesn't mean every integration is finished or generally available.
Other items in the announcement:
- Model builders: Nvidia says agents from Anthropic, Cohere, Google, Meta, OpenAI, Perplexity, Reflection and SpaceX Super Intelligence can run on OpenShell infrastructure.
- Banks: BBVA and Santander are exploring the architecture as a framework for agent safety, security and governance. That is exploration, not deployment.
- SAP: it is integrating the architecture with its Joule Studio runtime.
- ServiceNow: it made Arc, a long-running personal agent, generally available on Wednesday, with actions enforced by OpenShell.
- Hardware makers: Dell, Cisco, HPE, Lenovo and Supermicro are among those building infrastructure with it.
Telemetry: read this before you deploy
The Register points out that OpenShell collects telemetry by default. Nvidia's README gives more detail. It says the telemetry is anonymous and limited to operational categories and counts. It says OpenShell does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. Those are Nvidia's statements, not an external audit.
To turn it off, the README says to set OPENSHELL_TELEMETRY_ENABLED=false on the gateway. For Helm installs, set server.telemetryEnabled=false. It also says telemetry can be compiled out entirely. Opting out covers OpenShell's telemetry only. Third-party services, model providers, inference endpoints, agents and tools you connect may have their own terms and privacy practices.
The performance claims
Nvidia puts numbers on the hardware:
- Vera Rubin NVL72 delivers 30x higher throughput per megawatt for agentic workloads.
- Vera CPUs deliver 2x the performance of x86 processors.
- Sentry on BlueField-4 boosts agent capacity by up to 20%.
- CoreWeave measured more than 3x faster sandbox startup and 1.8x faster agentic-loop completion versus a leading x86 CPU. It also measured over 11,000 concurrent agent environments per rack.
All of these are vendor-published figures. They measure execution speed and density, not how well the security controls work. The material doesn't give enough testing detail to apply them to other hardware or workloads.
Analysis: what this means for IT teams
The real shift is architectural. Putting enforcement outside the agent, and optionally outside the host CPU, is a sensible response to how agents behave. The Register cites security testing by OpenAI and Anthropic in which models exceeded their remit and attacked third-party organizations. The Register also notes that OpenShell still has a few open security-related issues on GitHub. A governance layer is software too, and it can have bugs.
The case for it is simple. Agents that touch files, credentials and networks need least-privilege boundaries, an audit trail and a kill switch. The case for caution is also simple. The full stack is tied to Nvidia silicon. Several partnerships are early. Windows details are thin. Nothing here replaces threat modeling, credential hygiene and human review of policy changes. Even the Policy Prover only checks permissions against a ceiling that your organization defines.
Practical steps for admins evaluating this:
- Separate the OpenShell software runtime from the optional BlueField and Sentry hardware layer, and decide which you actually need.
- If Windows is in scope, ask Nvidia and Microsoft for the MXC support matrix, prerequisites and status before committing.
- Decide your telemetry stance up front and set the gateway option accordingly.
- Check which partner integrations are shipping today versus announced.
- Treat the speed and "milliseconds" claims as unverified until you test them in your own environment.
The takeaway: Nvidia is offering a layered, vendor-led answer to the agent-control problem, and it explicitly includes Windows. The main open questions are what that Windows support looks like in practice, and how much of the stack you need.