Nvidia ties the quarantine layer of its open-source agent sandbox to its own chips

Whoever installs OpenShell on Monday starts by writing a list ^[2]. The person filling it in decides what each agent needs. If an agent's job is answering billing questions, the billing database goes on the list, and the sandbox lets the agent in. In Nvidia's design, stopping an agent that misuses access it was given falls to the second layer ^[4].

The two published accounts disagree about that second layer. Morning Brew relays Nvidia's description of OpenShell as a two-layer, open-source system that any company can adopt ^[1]. BusinessToday describes a bundle of open-source software and a hardware-based security layer ^[3], with Sentry running on BlueField-4 data processing units as an independent monitor ^[5]. Read together, the free download is the sandbox, and the millisecond quarantine runs on Nvidia silicon. Neither report includes a price for Sentry or the chips under it ^[3][5].

Nvidia names Microsoft, Perplexity and JPMorgan Chase among its adopters ^[9]. A list of logos measures sales reach. A buyer needs usage depth: how many agents each organization runs inside the sandbox, and how often Sentry has actually quarantined one. Those figures will come from a pilot. The Hugging Face claim ^[10] is a hypothetical, made by Nvidia about a platform it bought for $13 billion this month ^[6].

Jensen Huang's public line fits the product. Two weeks before the launch, Sam Altman and Dario Amodei called for developers to slow down and asked for more government regulation ^[8]. Huang disagreed, and told CNN: "If they believe their company is out of control, then get the company under control." ^[7] OpenShell is Nvidia's offer of a way to do that, with the fast half on its own hardware ^[5].

Sort each agent on two lines before choosing. One is whether you can write its access list today from the systems its job requires. The other is whether a bad action inside that list can wait for someone reading logs the next morning, or has to be stopped while it runs. An agent with a writable list and a next-morning tolerance fits the open-source sandbox alone, and the cost is the hours spent keeping the list current. If the list is writable but the agent must be stopped mid-run, it belongs in the Sentry box, and the decision turns on a BlueField-4 quote from Nvidia. Where nobody can yet write the list, start there, because the sandbox would enforce a policy no one has set. I'd start with one agent in the first box. The tradeoff is that the first box catches misuse after the fact, since in Nvidia's design the mid-run stop belongs to Sentry ^[4].