The shift is from guarding the perimeter to guarding the agent itself. Nvidia has laid out Sentry, a security framework that watches AI agents from hardware the agent cannot reach, and chip-design software maker Cadence has launched a set of AI models built on Nvidia’s open Nemotron model that customers can keep behind their own firewalls. Together they show what’s changing in enterprise AI: companies want agents, but they want proof the agents stay in their lane.
Sentry: A Watchdog Outside the Agent’s Reach
An AI agent can finish its assignment and still cross a security boundary, Nvidia notes, and recent incidents show agents getting around controls while using tools, credentials and services to chase their goals. So monitoring has to sit where the agent cannot alter or disable it.
Sentry is Nvidia’s answer. It is part of the OpenShell reference architecture announced at GTC Berlin, built on Nvidia DOCA and run on BlueField-4 DPUs, and it enforces policies on what agents can reach: models, tools and data. In the reference design the agents run on Nvidia Vera CPUs while BlueField-4 sits on the node’s only path to the model, so Sentry can inspect agent-to-model traffic without relying on the agent to report itself. OpenShell, the secure runtime, keeps policy enforcement separate from the agent’s workload so a compromised agent cannot rewrite its own restrictions.
Under the Hood
DOCA Tower is the gateway. Built on the open source Envoy proxy, it acts as a transparent proxy that inspects traffic in both directions. A per-agent layer-4 firewall, built with DOCA Flow and accelerated in silicon, blocks unauthorized destinations and passes allowed traffic to Tower for application-layer checks. Policies are evaluated by Open Policy Agent, which runs in memory and can answer requests in under a millisecond, depending on policy complexity.
DOCA Argus adds context. It uses live memory introspection to map containers, processes and loaded libraries without software installed on the host. Sentry cross-checks what Tower sees on the network against what Argus sees in memory. Warning signs include unapproved tools, excessive outbound traffic, unauthorized file changes and large-scale file deletion. When Sentry spots a deviation it can request containment on a millisecond scale, without the agent’s or host’s cooperation. The system also keeps tamper-evident records that an agent cannot edit from inside its sandbox. Nvidia plans availability early next year.
Cadence Goes Open-Weight
Reuters reported that Cadence Design Systems launched its portfolio of chip-design AI models on Monday, deepening its tie to Nvidia. The suite, Cadence Maestro, is built partly on Nemotron and secured with OpenShell. Customers can run it on Cadence’s cloud or any public cloud, or keep it fully in-house behind their own firewalls and data centers. They can also fine-tune on their own chip designs, and early results show up to 30% higher quality and up to five times better cost-efficiency than general-purpose models, Cadence said.
That runs against rival Synopsys, which said on September 30 it would build a model with OpenAI, share revenue with the ChatGPT maker and run it on OpenAI-hosted infrastructure. Cadence SVP Paul Cunningham calls Maestro model-agnostic, noting “there are more (AI) model providers out there than there are (chip design software) vendors.” Asked about deals with proprietary labs, he said open- and closed-weight approaches are being “pursued equally.” The first Maestro models reach select early-access customers in the fourth quarter.
Sources
- Nvidia
- Inside NVIDIA Sentry: Secure AI Agents at Runtime | NVIDIA Technical Blog
- Cadence unveils Nvidia-backed AI models that chipmakers can run in-house
Photo: Anderseidesvik (CC BY-SA 4.0)
