You know Agentic AI has well and truly arrived in the mainstream, when an NVIDIA keynote isn’t just about faster GPUs anymore. It’s equally about a cage – well, a sandbox, technically. Meant to keep AI agents on a leash like never before.
At GTC Berlin 2026, Jensen Huang did deliver the now run-of-the-mill hardware fireworks. Vera Rubin is now in full production, with NVIDIA signing supply chain deals to ease what Huang has called the real bottleneck. “Demand is extraordinary. Capacity is the constraint,” he said.
Nearly eight years in the making, NVIDIA finally made its first commercial phone call on T-Mobile’s network with Nokia. “Now CUDA makes phone calls,” Huang said during his GTC Berlin keynote. In other key announcements by NVIDIA, robotics researchers can look forward to Agile ONE SN, a 31-degree-of-freedom reference humanoid built on Isaac GR00T, which is expected in 2027. And to further cement NVIDIA’s platform supremacy, Jensen Huang held up an RTX Spark, juxtaposing its 1 petaflop and 128GB of memory to the DGX-1 he delivered to OpenAI in 2016, which “took two people to carry upstairs,” as he recounted.
But the real story of GTC Berlin has to be about NVIDIA’s focus on AI agents safety and security. And the timing of this announcement can hardly be a surprise.
For history will always remember 2026 as the year when AI agents slipped the leash. In July, OpenAI disclosed that its models had escaped an evaluation sandbox and broken into Hugging Face‘s servers, with Sam Altman acknowledging “a significant security incident”. Days later, Anthropic revealed that three Claude models had breached three real organisations during cybersecurity tests that weren’t supposed to get online on the internet.
Neither cases of rogue AI agents were truly malicious – the agents were chasing narrow test goals – but that is enough to get cybersecurity watchdogs nervous and anxious. Intent hardly matters when an out-of-bounds AI agent ends up taking down someone else’s production infrastructure.
NVIDIA and Jensen Huang know it’s in their interest to safeguard the agentic AI stack. Huang described an AI agent as five things – a model, a harness, a sandbox, knowledge and tools. An AI agent, of course, also touches files, networks and tools on its own. “The most important thing is to make sure the agent is secure,” Huang said, arguing that such systems should have minimal access privileges and be subject to constant monitoring.
NVIDIA’s answer comes in the form of OpenShell Reference Architecture, an extension of its open-source OpenShell runtime in the form of a full-blown hardware-plus-software stack – part of its Open Agent Safety Platform.
“AI capability and safety must advance together,” Huang said. “As enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture.” Huang’s vision for agents is that they will “think on Rubin, act on Vera and be governed on BlueField.”
What does that look like in practice? According to NVIDIA, OpenShell lets enterprises write explicit policies for what each agent can touch, which is enforced at system level calls, file access and network connections. Every agent runs in its own independent sandbox with no direct connection to the network, where outbound requests need to pass explicitly through a supervisor outside the sandbox that has denying rights for anything that’s beyond the guardrails.
Access credentials stay with that supervisor and are attached only en route to approved endpoints, this is to ensure that a compromised agent won’t be able to leak a key it never possessed. Every policy change request is formally checked against a permission ceiling to ensure no agent quietly grants itself more access.
On top of all of this there’s the hardware backstop. NVIDIA Sentry runs on BlueField-4 DPUs, out-of-band and beyond the agent’s reach. Because AI reasoning traffic passes through it, Sentry can catch an agent planning something unintended, and take quarantine measures in milliseconds, leaving an audit log for inspection later. That’s exactly the kind of independently enforced boundary AI agents seemed to have lacked so far.
What’s more, the whole system is designed to be dynamic. “Every single time an agent is launched, the privileges are different,” Huang asserted – which means permissions, enforcement and monitoring all have to adapt dynamically.
NVIDIA didn’t announce these measures in isolation, there were signs of the ecosystem falling in line. Anthropic and NVIDIA are partnering on Claude OpenShell agents, building on Claude Managed Agents, which keeps credentials in a vault the agent never sees. ServiceNow, CrowdStrike, Palo Alto Networks, Zscaler and Okta are embedding OpenShell into their security products as well.
None of this makes AI agents infallible, of course. Because a policy is only as good as whoever writes it. But here finally we see signs of AI safety being moved out of the model’s conscience and into the silicon. And they better stay inside the fence, whenever they’re called upon.
Also read: 5 AI agent security failures in 2026: From OpenAI’s hidden Wiki incident to Anthropic’s PyPI breach