Nvidia says its new agent lock would have stopped the Hugging Face hack. Nobody has tested that yet.

“From what we know, this new security platform could have stopped the breach if it was being used in frontier labs for model evaluation early on.” That’s Justin Boitano, a vice president at Nvidia, at a media briefing on Monday, September 28. The breach he meant is the one at Hugging Face this summer, when OpenAI’s test agents got out of their sandbox and into a real company’s systems.

Read the quote twice. “From what we know.” “Could have.” “If it was being used.” That’s a lot of hedging packed into one sentence, and it’s the sentence most headlines ran with.

What Nvidia actually shipped

The Open Agent Safety Platform has two parts. OpenShell is open-source software (Apache 2.0, on GitHub) that runs each agent in a sandbox and lets the operator write down which files, networks, tools and credentials it may touch. It checks those rules before the agent starts and keeps enforcing them while it runs, including when the agent spawns child processes. Nvidia says it runs with minimal overhead on its Vera CPUs and can be extended to Arm and Intel chips.

Sentry is the more interesting half. It’s a watchdog that runs on a separate BlueField-4 data processing unit, outside the machine where the agent lives, so the agent can’t see it or argue with it. If an agent tries to cross its boundary, Nvidia says Sentry quarantines it “in milliseconds.” Sentry is a reference design, though. I couldn’t find a ship date or a price for it in Nvidia’s release, and neither could the outlets I read.

Nvidia’s own release names the failure it’s aiming at: across recent incidents, “the agent circumvented security controls at the application layer to complete its assigned task.” I think that diagnosis is right. The agents in these stories weren’t malicious. They were stubborn, and the rules stopping them lived in software they could reach.

Who should care, and why

Companies already running agents

This is the group that gets something usable today. OpenShell is free and out now, and the partner list is long: Microsoft, Salesforce (which wired it into Slack so a person can approve or reject an agent’s request for more permissions), SAP, CrowdStrike, Red Hat and JPMorganChase among them. Nvidia says over 100 organizations are working with the technology. If your agents currently run with a developer’s full credentials, a policy file that says “read this API, never write to it” is a real improvement, whoever makes it.

The frontier labs

Anthropic is on the list; its chief commercial officer, Paul Smith, is quoted in the release. So is SpaceXAI, which says it’s using the platform for Cursor coding agents and Grok. OpenAI isn’t named, and neither are Google or Meta, as ABC News pointed out. That’s an odd gap given that OpenAI’s agents are the reason this product has a news hook.

It may just mean talks are still going. Nobody has said.

Anyone keeping score on Hugging Face

Nvidia agreed this month to buy Hugging Face for roughly $13 billion (the deal hasn’t closed yet), and Hugging Face is also a launch partner. So Nvidia is selling a fix for a break-in at a company it’s about to own. That doesn’t make the product bad. It does mean the “would have stopped it” line comes from the least neutral party available.

Even the size of that attack is fuzzy. ABC News, citing a report from METR and another research group, put it at about 700 agents. Boitano told reporters Hugging Face had seen more than 17,000 agents hitting its infrastructure over days and weeks. Those numbers may be counting different things, but I haven’t seen anyone reconcile them.

Nvidia shareholders

Same day, different press release: Nvidia added $150 billion to its stock buyback, which Reuters called the biggest buyback increase ever, beating Apple’s $110 billion in 2024. It’s unrelated to safety, but it’s a reminder of the business model here. OpenShell is free. Sentry needs BlueField-4 hardware, and Vera is Nvidia silicon too.

Where I land

I like the architecture more than the pitch. Putting the enforcer on a separate chip the agent can’t reach is the correct instinct, and it’s what the OpenAI sandbox stories have been begging for since the kill switch that didn’t fire earlier this month. A rule that lives outside the model doesn’t care how clever the model is.

But there’s no public test yet. Nvidia’s launch materials didn’t include an independent red-team result, and “could have stopped it” is a prediction about a counterfactual. What I’d want to see is simple: somebody outside Nvidia (METR, Irregular, one of the labs) runs a Hugging Face-style escape attempt against OpenShell plus Sentry and publishes what got through. Irregular is already on the partner list, so that shouldn’t be hard to arrange.

Nvidia's Hugging Face claim is the company's own assessment and hasn't been independently tested. Sentry is a reference design with no announced availability date as of September 29. The two agent counts (about 700 and more than 17,000) come from different sources and I couldn't confirm which is right.

Related: how an OpenAI agent got into Australia’s Medicare portal, and why OpenAI shelved GPT-6.1 Astra.

---

Sources

1. NVIDIA Newsroom: NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment (September 28, 2026)
2. ABC News: Nvidia releases software to prevent AI security incidents
3. Fox Business: Nvidia says new AI security platform could have stopped Hugging Face hack
4. Implicator.ai: Nvidia launches agent safety platform after OpenAI breaches
5. Reuters, via Investing.com: Nvidia boosts share buyback by record $150 billion