NVIDIA puts AI agent security on BlueField-4: monitoring and containment keep running in silicon even if the host is compromised
Synopsis
NVIDIA announced NVIDIA Sentry at GTC Berlin, a security framework that runs on BlueField-4 DPUs and places monitoring and policy enforcement for AI agents' access to models, tools and data in a separate hardware trust domain beyond host software. Earlier agent security relied on software runtime boundaries, so an agent that escaped its sandbox could alter or disable its own restrictions; Sentry inspects agent-to-model traffic through the DOCA Tower transparent proxy and reads runtime state outside the host with DOCA Argus, containing agents at millisecond scale. The framework is planned for availability early next year, and developers can begin with DOCA Argus, DOCA Flow and other libraries and microservices to experiment with out-of-band observability and infrastructure enforcement.
Interpretation
Security monitoring and policy enforcement for AI agents move out of host software and onto a separate network card sitting on the agent's only path to the model. The prior approach relied on software runtime boundaries, and an agent could complete its assignment while circumventing security controls as it used tools, credentials and services, with those controls themselves within the agent's reach to alter or disable. Sentry runs on BlueField-4 DPUs on the node's only path to the model, so all of an agent's network communications pass through it; even if an agent escapes its sandbox, monitoring and enforcement continue from BlueField-4's isolated trust domain.
The framework combines network-layer inspection with observation of the runtime environment to decide whether an access request is allowed. Network communications alone provide only part of the information needed to assess an agent's security and integrity; the process behind a request and the environment it runs in also matter. DOCA Tower acts as a transparent proxy with bidirectional inspection of agent traffic and evaluates requests against policies using Open Policy Agent; DOCA Argus performs live memory introspection on BlueField-4, mapping containers, processes and loaded libraries to their hashes, and the correlated context lets a policy require an approved container hash, an initiating process listed in the container SBOM, and permission to open network connections.
When behavior deviates from designed intent, the framework can contain the agent within milliseconds without cooperation from the agent or host software. When software boundaries fail, logs and restrictions on the host may already have been altered by the agent, leaving investigation and response without trustworthy evidence. DOCA Tower records inspected communications and policy decisions outside the reach of the agent and host software, while DOCA Argus contributes independently observed runtime signals, together forming attested tamper-evident records that Sentry can use to request in-silicon containment on BlueField-4.
Perspective
The protection targets agents running in the NVIDIA OpenShell reference architecture, where agents execute on Vera CPUs and BlueField-4 sits on the node's only path to the model. The material addresses developers and cybersecurity teams, describes mechanisms and integration paths, and notes that DOCA Argus, DOCA Flow and OVS-DOCA libraries and microservices are available now for experimenting with out-of-band observability and infrastructure enforcement, while Sentry itself is planned for availability early next year.
The material reports no measured figures for block rate, false-positive rate or performance overhead, and notes that Open Policy Agent's sub-millisecond evaluation depends on policy complexity and configuration. Sentry is planned for availability early next year; what can be tried now is the DOCA libraries and microservices, with core plugins still to be published.