Nvidia has released a software platform meant to keep AI agents from misbehaving, according to CNBC. My honest first reaction: it's about time.
The AI boom has run for most of this decade. Yet much of it has shipped with a security mindset that feels closer to 2001 than 2026. We have understood how to lock down systems for a very long time. Somehow, when agents arrived, a lot of that knowledge got left at the door.
The basics we forgot
Traditional system security starts with the user account. You log in, and that account carries a set of privileges: what you can touch on the machine and on the network.
The catch is that every action fired off during that session runs with those same privileges. If you are logged in as root, then anything that runs, whether it's you, a piece of malware, or an AI agent, can do anything root can do.
That is why old-school administrators locked users down hard. No installing software, no registry access, not even adding a printer. It sounds harsh, but it works. When someone clicks a spear-phishing link, the malicious script tries to run and simply fails, because the account has no permission to do what the script wants.
This is defense in depth. Security should be layered like an onion. One layer gets breached, the person clicks the link, and the next layer still holds. Agents that can create and delete files, folders and entire databases from a shell need exactly this kind of layering. Too often, they don't get it.
"Trust your developers" is not a security model
Developers want root on their machines because they do a lot on them. Fine. But when an agent runs inside that developer's session, it inherits all of that power. The obvious question for anyone building agent tooling is: where is the Active Directory of the agentic era? Where is the layer that separates what the human can do from what the AI working on their behalf can do?
Ask that question in the wrong room and you may hear a startling answer:
"Well, you trust your developers, don't you?"
No. You don't trust people. You build systems, and you trust the systems. Distrust, verify, stay suspicious.
The results of ignoring this are already public. We've seen founders and senior engineers post emotional accounts of an AI coding tool wiping out their production database. The real story there isn't that the tool was bad. It's that the agent had permission to drop production data in the first place. File and database permissions should have made that impossible.
Everyone in tech has broken something. The professional response is to restore from backup or recovery, put everything back together, and fix the access controls so it can't happen again. Not to blame the tool for doing what you allowed it to do.
If the labs struggle, what chance do you have?
Here is the question I keep coming back to. The biggest AI companies employ some of the best engineers alive and build these models themselves. If even they face serious questions about keeping their own agents in check, why should a typical company assume it can control the agents it deploys?
The incidents are piling up. Per CNBC, Nvidia's vice president of enterprise AI, Justin Boitano, cited a Hugging Face report of more than 17,000 agents hitting its infrastructure over a stretch of days and weeks.
No one can monitor everything, and small actions can snowball into big outcomes. But an agent contacting a site once is noise. An agent hitting it thousands of times should trip an alarm. Activity at that scale running for weeks points to a failure of basic monitoring and accountability by whoever operated those agents. That isn't a "rogue AI" problem. It's an operations problem, and the people responsible should answer for it.
What Nvidia is actually shipping
Nvidia's pitch is an engineering answer to agent safety rather than a model-level one. CEO Jensen Huang told CNBC that agents can't be allowed to drift around a company unchecked, and described the platform as a kind of browser for agents: a container that only gives an agent access to what its task requires.
The platform has two notable pieces:
- OpenShell runs on CPUs and sets limits on what an agent is allowed to do. In plain terms, privilege limits for agents.
- Sentry monitors agent behavior and runs on networking chips rather than CPUs or GPUs. Think network monitoring: watch traffic in and out, act when thresholds are crossed.
Nvidia's own framing is the key admission: safeguards inside the model alone can't govern what agents access or do. Of course they can't. Systems have been built in layers for decades. Putting all the safety inside the model never made architectural sense.
It's a little comical to hear sandboxing and least privilege presented as breakthroughs in 2026. This should be version 20 of something that's been standard for years. Still, better now than never.
Chaos Monkey for agents
Netflix popularized the Chaos Monkey idea more than a decade ago: your infrastructure should be so redundant you could walk into the data center and start yanking cables. What happens when a network card dies? A CPU fan? Fifty servers at once because their drives all came from the same bad batch?
Agents need the same thinking. Before you wire one into your systems, ask whether it can survive bizarre, unexpected edge cases, and what happens when it can't. How is it designed to behave when things go sideways?
That is the job of system-level and network-level controls. When an agent hits an edge case no one anticipated, those layers should alert you, contain the damage, and, if nothing else, let you pull the plug. However impressive an agent looks in a demo, the real question is whether it's reliable enough to deploy without them. Usually it isn't.
The bigger problem: fundamentals
Part of why we're here is a skills gap. Plenty of capable developers today have never had to think about a default gateway, file permissions, or network segmentation. That gap was visible a decade ago, and agentic tooling makes it far more expensive.
Nvidia deserves credit for building the guardrails the industry should have demanded from day one. But no product replaces fundamentals. Least privilege, layered defenses, monitoring with real thresholds, and backups you've actually tested are what keep an agent's bad day from becoming yours.
What do you think? Is Nvidia filling a real gap, or should this have been standard years ago?
Sources: reporting by CNBC on Nvidia's agent safety platform.