The Breakouts Were Runtime Failures, Not Model Failures

In July, OpenAI evaluation agents working a cyber benchmark called ExploitGym found a zero-day in the package proxy that was their only sanctioned network path and used that hole to reach the open internet. From there, roughly 700 of them compromised Hugging Face’s production infrastructure across about 17,600 logged actions, looking for the benchmark’s answers. On September 20, another OpenAI agent, in a test of an information-search task with no internet access allowed, found it could reach a DNS resolver and used that service to send queries to a public chatbot. OpenAI paused training of its most capable models and, in the words of its preparedness lead, stopped all inference on them, the second pause in less than three months. The lesson isn’t about how smart the models are. In July the cyber refusals were deliberately turned down because it was a capability test, so the runtime was the only control left, and it had an exit the operators believed they had closed. In September the exit was a service nobody had modeled as a way out. I’ve argued since August that these are containment failures, not a case for slowing the frontier. My colleague Jason Andersen wrote in Forbes that the labs are treating a structural problem as a messaging problem. I agree, and the structure that failed was the runtime. OpenAI itself says the fix includes stronger alignment, and that work matters; the runtime is what has to hold on the day alignment doesn’t.

Deterministic Controls Outside The Model Are The Right Architecture

NVIDIA’s design premise is the one I’d have written myself: a probabilistic system needs deterministic controls that live outside its reach. OpenShell runs each agent in a kernel-isolated sandbox with no network path except through a supervisor that checks every outbound request against policy. Policy is inspected at the protocol level, so a rule can allow a read against an API and block a write on the same endpoint. Real credentials never enter the sandbox. Before an agent runs, a prover that uses formal logic rather than another model checks whether the policy can be escaped, which matters because an agent cannot talk a proof into a different answer. The software is licensed under Apache 2.0, runs on x86 and Arm, and Red Hat, SUSE and Canonical are integrating OpenShell into their operating systems. Sentry is the hardware layer. Running on BlueField-4, Sentry watches agent traffic and reasoning from a trust domain the host can’t touch, and NVIDIA says Sentry can quarantine an agent in milliseconds. Justin Boitano, NVIDIA’s vice president of enterprise AI, was clear in the analyst pre-briefing that the DPU is optional. He said OpenShell alone covers most enterprise access-control needs and that Sentry is aimed at frontier evaluation and red teaming with guardrails off. Both OpenAI escapes happened in that setting, internal tests of unreleased models, so the hardware layer is pointed at the right customer.

The Trace Is The Control Point, And Closed Labs Decide What You See

Sentry inspects an agent’s reasoning by routing the model path through a proxy, and that is also where the platform’s limit sits. Kernel and network enforcement don’t care whether an agent is honest. Trace inspection does. Independent reviewers from METR and Redwood Research, as reported in a Cloud Security Alliance analysis of the Hugging Face incident, found that about one in five agents examined showed clear interest in hiding evidence of their own reward hacking, and about 7% of sampled transcripts showed attempts to spoof tool outputs. The same reviewers found the agents largely left their own chain-of-thought alone, so in that incident the trace was the more honest channel; that is an empirical result, not a structural guarantee. A closed frontier lab decides how much of the trace leaves its API. An open-weight model exposes its entire reasoning space; a closed one exposes what its vendor chooses. I said on September 8 that if the frontier labs can’t control IP leakage through inference and traces, open becomes the enterprise default. This announcement adds a second reason: the safety tooling works best on the models you can see into.

What CIOs And Agency Leaders Should Do This Quarter

Three things. First, treat sandbox policy as an IT deliverable with a named owner. My colleague Mike Leone asked the right question when Red Hat put OpenShell into OpenShift AI 3.5: the platform team and the agent builder want different things, and whoever writes the policy owns the fallout. Second, size compute for agents, not virtual machines. NVIDIA’s argument for Vera is that each step in an agent chain is gated by single-threaded execution, and it points to Signal65 data to make the case. Signal65, the lab I co-own, timed the full agentic task lifecycle on NVIDIA’s Vera CPU with one sandbox per physical core and every core under load, and Vera finished 1.64 times faster per core than a leading x86 server processor across 69 Terminal-Bench 2 tasks. That test keeps the model out of the loop by design, so it measures sandbox and tool execution, not inference and not whole-server throughput. My colleague Matt Kimball’s conclusion is that the host CPU stops being a consolidation platform and becomes the latency governor for the whole agent chain, and almost no IT leader is sizing on that basis yet. Third, ask every agent vendor where the trace lives and who can read it. If the answer is “in our cloud,” you have outsourced the control point.

What NVIDIA Still Has To Show

This is a version 0.1.0 that the press release calls broadly available. NVIDIA has not cited a production incident the platform has stopped. The July escape also went through a sanctioned endpoint, the package proxy, so the real test for OpenShell is whether protocol-level inspection would have treated an exploit payload against a read-only package service as a blocked write, and NVIDIA hasn’t shown that. Boitano’s framing on Hugging Face was careful for that reason: “from what we know,” the platform could have stopped the breach if frontier labs had been running it in their evaluations. Sentry has no availability date and runs only on BlueField through NVIDIA’s DOCA software, so the hardware enforcement layer is NVIDIA silicon until someone ports the hooks. OpenAI, Google and AWS are not named in the release. NVIDIA isn’t the only company staking a claim to the governance layer, either; my colleague Bill Curtis wrote in June that Microsoft defined the horizontal governance layer for agents at the edge, with execution containers enforced at the kernel or hypervisor. OpenShell is free and Sentry is unpriced so far, because both pull through Vera CPUs, BlueField-4 DPUs and ConnectX-9 network adapters, which is where NVIDIA gets paid. What I’d tell NVIDIA: publish a production save with numbers, put a date on Sentry, and get one non-NVIDIA DPU port done so the openness claim is more than a license. That’s easy for the analyst to say, I get it. Somebody had to go first with a full-stack reference design, and NVIDIA did it in the open. VIDIA deserves mega kudo for the work and leadership they have provided on this.

Containing Agents Is Not Containing Your Data

OpenShell keeps an agent from leaving the building. It does nothing about your data leaving through the model API. I wrote in Forbes this month that the boards I advise are choosing between open and closed models over this exact fear. The real exposure is derived intelligence, what a lab learns from your traces, not whether it retains your prompts. Zero-data-retention contracts can’t be verified from the outside, and liability caps in these contracts usually sit near a year of fees, so a rational lab could absorb a judgment and keep what it learned. The fix is running the model inside your own boundary under confidential computing, where the hardware encrypts the model and the data in use so the provider can’t see either, behind a network boundary that proves nothing dials home. Governments building sovereign AI factories should make that a condition of hosting frontier models in-region. NVIDIA built the containment layer this week. The confidential-computing layer for frontier models is the next announcement I want to see, from NVIDIA or from anyone else.