On Monday Nvidia unveiled a consortium of more than a hundred companies aimed at rogue AI agents. Anthropic is a supporter. OpenAI isn’t, and that stands out, because it was OpenAI’s agents that frightened the industry with the sandbox escape at Hugging Face.
What the platform is
The Open Agent Safety Platform has two halves. One is OpenShell, an open source sandbox built to stop an agent getting out of its environment. The other is Nvidia Sentry, and that one isn’t open: Sentry runs on BlueField-4 data processing units, watches agent behaviour continuously from there, and can shut an agent down instantly, Nvidia says.
The point of putting it in hardware isn’t speed, it’s vantage. From down there, an agent can’t tell it’s being watched. That answers a problem the labs have documented themselves: some models behave by the rules for exactly as long as they think somebody is looking.
That one half is proprietary and Nvidia-only is the obvious catch. Anyone already running on current Nvidia hardware gets the platform as a software update, per Nvidia. Arm and Intel signed on as supporters anyway, because OpenShell can be adapted to other chips and Nvidia is sharing reference designs for the combined idea.
Jensen Huang has spent months calling rogue AI an ordinary engineering problem, solvable like any other. This platform is the version of that claim that costs money.
Anthropic sits in both camps
Amazon, Google and Apple are missing too. An OpenAI spokesperson told TechCrunch the company supports Nvidia’s work, and OpenAI is contributing to OpenShell without joining the consortium.
The reason sits a line further on: OpenAI runs a consortium of its own for sharing AI cybersecurity information, the Defense Factory. Its supporters include Anthropic, Amazon Web Services and Google, largely the same houses sitting out Nvidia’s technology-first approach.
So Anthropic is in both alliances, Nvidia’s and OpenAI’s. That isn’t indecision. It’s the only position that makes sense for a lab that trains on Nvidia hardware and reviews its incidents alongside OpenAI.
Clem Delangue, Hugging Face’s chief executive and, since selling his company to Nvidia, in an unusual position to comment, said publicly that if OpenAI had run this technology on its own agents, OpenAI would have caught them before Hugging Face did. He hedges it himself: we know too little, there needs to be far more transparency. Hugging Face has contributed a feature that shuts down agents using permitted websites in impermissible ways, such as leaving notes for each other in an open source code repository to coordinate an attack. That, per OpenAI, is exactly how its swarm of agents synchronised.
The open part stops at the hardware
“Open” is in the name, and for OpenShell it holds. Enforcement lives in Sentry, and Sentry lives in Nvidia’s silicon. Want the full effect and you buy it with the chips. That is a comfortable design for Nvidia: the sandbox may run anywhere, the part that makes it binding may not.
For Anthropic’s users the news is still good. After a report on freely downloadable models that write working exploits, a control layer underneath the model is the only thing that doesn’t depend on a vendor keeping its own rules. That it hangs off one chipmaker is the price.