NVIDIA's fix for agents that escape is a boundary outside the model and a kill switch the agent cannot see

What actually shipped

Where the boundary sits

• The Gateway manages the lifecycles and policies of many sandboxes, which makes a fleet possible rather than a single agent.
• The Supervisor sits beside each sandbox, outside the agent's process, and checks every outbound request against policy.
• The Sandbox runs the workload with kernel-level limits on which files it can read or change, and with no network path except through the supervisor.

Five controls the runtime actually enforces

• Outbound traffic is denied by default. A rule names a host, a port, a protocol, an access mode and the specific programs allowed to use it — /usr/bin/curl reaching one API on port 443, for instance. Everything else fails, and the agent receives a descriptive error it can reason about.
• Inspection separates reading from writing. With a REST, GraphQL or MCP rule set to read-only, the same endpoint accepts a GET and refuses a POST, so a credential with write permission no longer implies a write from the agent.
• Real credentials stay outside the workload. The agent holds a placeholder; the supervisor substitutes the real provider credential on the far side, and only toward endpoints that credential is approved for.
• Policy is code, and it is checkable before it runs. Rules are authored in YAML, compiled to OPA/Rego, the policy language Open Policy Agent evaluates, and a formal prover checks what a proposed change would newly allow.
• Every decision lands in an audit trail. Policies are written in OCSF, an open schema for security logs, and an agent can request a narrower change to a running sandbox only through a path a human approves by default.

The gap between detecting and stopping

The watchdog in the network chip

What the ecosystem is already building on it

Where your product sits

• Your agents write to production data or call internal APIs. Test the cheapest two controls first: deny-by-default egress and credentials held outside the workload. Both are configuration, both are free in the open-source runtime, and both change what a compromise costs. Fit them into the sprint before your next agent gets write access.
• You buy agent infrastructure from a platform vendor. Ask which partner component sits in the runtime and where the audit trail lands, because 100-plus integrators with no shared audit standard leaves the log format to you. Raise it at the next architecture review.
• You run your own GPUs or plan a refresh. Decide this cycle whether Vera and BlueField-4 belong in that plan. The software layer travels to any infrastructure; the layer that survives a compromised host stays on NVIDIA silicon. Put the question in the hardware plan, where the budget cycle will force an answer.
• You own model risk or security review. Add "agent reached a system it was not authorised to reach" to the threat model and set the response target from the incident timeline, where detection took minutes and the stop took hours. Write that target this quarter and measure it in the next red-team exercise.

A three-week pilot

1. Fix the pass condition first. One agent task completes while reaching only the systems on a list you can show an auditor.
2. Inventory the authority. For one agent, write down every file path, endpoint, credential and program it can use today. That list becomes the policy.
3. Stand up one sandbox with egress denied by default. Run the same task inside it and outside it, and count the blocked requests that were legitimate work.
4. Move one credential outside the workload. Confirm that a request to an unapproved host fails while the agent holds a placeholder.
5. Red-team the boundary. Point a repository-to-runtime scanner at the agent, record what it tried, and close the paths it found.
6. Read the results against the condition you fixed in step one, and keep the rollback to one policy file.

The decisions, with the clock on them

The platform facts here come from NVIDIA's launch materials and the technical documentation it published on 28 September, with CNBC and The New Stack confirming the launch and the partner list. The claim that the platform could have prevented OpenAI's July Hugging Face incident is NVIDIA's own, made by a company representative on a Sunday press call; NVIDIA's vice president of enterprise AI, Justin Boitano, also cited Hugging Face's report of more than 17,000 agents attacking its infrastructure during that incident 2. The incident timeline is OpenAI's account of its own training environment and carries nothing about the platform. The policy-prover experiment, the millisecond quarantine figure and the 80% sandbox-performance claim are NVIDIA's, taken from its own tests, and none has been reproduced outside the company. The two preprint results come from the papers and were run by their authors.