Nvidia launches Open Agent Safety Platform with OpenShell and Sentry chip to contain AI agents

The same people who said OpenAI should just airgap the network will now call this lock-in, a walled garden, a war on general compute. Ten bucks says next year it's in your laptop.

Both can be true at once. There's a trivial fix that doesn't cost us any freedom, so why should we accept the one that does? It's the protect-the-children argument for dragnet surveillance.

Airgap what network exactly? How's the agent supposed to push to GitHub or order a burrito on DoorDash with no network?

It's amazing that the solution a chip maker comes up with for a problem is selling another chip. Feels suspiciously good for Nvidia.

Pedantically, TSMC actually makes the chips. Nvidia designs and packages them.

The Sentry chip has to get it right every single time. The agent it's containing only has to get lucky once. The bomber always gets through.

Quis custodiet ipsos custodes? Who watches the watchdog chip? If it needs its own sentry chip we're fine forever, right?

None of this solves anything. An agent needs wide, unattended access to be useful, and any sandbox can be broken out of. Put a human in the loop and you've bottlenecked it into throwing away the productivity gains.

There's a middle ground being ignored here. Semi-automation with a human in the loop still gives a dramatic uplift. A combine harvester can't run fully autonomous and nobody stopped trying to get as close as possible.

Running untrusted workloads at scale is a solved problem. Cloud providers landed on VMs plus proper observability. Same playbook applies to agents.

A coding agent needs write access to the source and read and execute access for build and test tools, not much else. Nobody needs to hand it SSH keys. Wide access isn't inherent to the job.

This is just the trusted-admin problem. If you don't trust an admin with elevated privileges they can't fix anything on your network. Either trust the agent enough to push commits and run tests, or you've made yourself a reverse centaur.

Heads up, this isn't even a new chip. BF4 is already the SmartNIC in most Nvidia server products. This is mostly new software doing WAF for agents at the host level.

Agents have an unresolvable tension between usefulness, safety, alignment and accuracy. Restricting access makes them safer but less useful, and even access controls can't be perfect, so better models actually need blunter restrictions, which cancels out the added utility.

We probe people before trusting them with risky decisions, and we know everything about a model down to its weights. The one thing we shouldn't do is let them evolve at their own pace with no oversight. Sacrificing some productivity is fine.