NVIDIA Sentry puts AI agent monitoring on the BlueField-4 chip, out of the agent's reach

Suppose an agent (AI software that calls tools on its own) escapes the sandbox (the isolated environment it was given). The first thing it can reach may be the software that monitors and logs it, because that software runs on the same machine. On October 21, 2026, NVIDIA published a technical post on NVIDIA Sentry, a security software framework that puts that monitoring where the agent cannot reach. Sentry has not shipped yet, but the question it raises applies to your own system today.

Where Sentry monitors the agent

The post was written by Ofir Arkin, Ariel Kit and Itay Ozery on NVIDIA’s technical blog. They state the problem: an agent can finish the task it was given and still cross a security boundary, because it uses tools, credentials and services to reach its goal. So, according to the post, monitoring and blocking must run out of the agent’s reach, so the agent cannot change or switch them off.

Sentry runs on BlueField-4, a type of DPU (data processing unit, a chip on a network card that handles traffic in place of the main CPU) from NVIDIA. In the company’s OpenShell reference architecture, the agent runs on Vera, NVIDIA’s CPU (central processor) line, while BlueField-4 sits on the node’s only path to the model, so all of the agent’s network traffic passes through it. The post describes three main pieces:

• DOCA Tower, the traffic-inspection gateway. (DOCA is NVIDIA’s software library for BlueField, which Sentry is built on.) Built on Envoy (an open source proxy, meaning software that relays traffic between two sides), it sits between the agent and the outside world and inspects traffic in both directions. It asks Open Policy Agent (an open source policy engine) whether a request is allowed; according to the post, the engine runs in memory and can evaluate a request in under a millisecond, depending on how complex the policy is.
• DOCA Argus, runtime observation. It reads the host’s memory from BlueField-4 without installing software on the host. It matches the processes, containers (packages of software that run in isolation with what they need) and files being accessed to each network request. That lets a policy require, for example, that the container’s hash be on an approved list and that the process sending the request appear in the container’s software bill of materials (SBOM).
• Behavior classifiers. Models running separately on GPU systems read the conversation and the tool calls to judge whether the agent still matches its designed intent or has drifted.

When it detects a deviation, Sentry can contain the agent within milliseconds, on the chip, without the agent or the host software cooperating. Logs are also kept on BlueField-4; according to NVIDIA, these are records that show signs if they are altered, meant for investigation even when the host cannot be trusted. This is NVIDIA’s own description, and the post gives no independent measurements. The company says Sentry is planned for availability early next year, while DOCA libraries such as DOCA Argus are available now for trying out observation and enforcement outside the host.

Three questions about where monitoring sits

You may not have BlueField-4 and you do not need it to ask the next three questions. They are this article’s suggestion and have not been tried on any system.

1. Where does the blocking sit relative to the agent? List every blocking step: traffic filter, policy check, file limit. For each one, note whether it runs on the same machine, in the same process or with the same permissions as the agent. If it does, a compromised agent may be able to change it. Try it: in a test environment, have the agent run a command that stops or edits that step and see whether it works.
2. Who writes the log about the agent? If the machine the agent runs on writes the log, an agent that escapes the sandbox can erase its tracks. Try deleting or editing one log line with the agent’s permissions. If that works, you need a place to write from outside that machine, or you should not treat the log as evidence.
3. Does every route out of the machine pass through a checkpoint? NVIDIA’s design puts BlueField-4 on the only path to the model and to the outside world. Check for a route around your checkpoint, such as a direct connection or a side port, by having the agent try to call out to the internet directly.

If all three questions have an answer you can write in one line, you know where your monitoring stands relative to the agent. If any answer is “don’t know”, do not give the agent more permissions until you do.

Sources

1. NVIDIA Technical Blog, “Inside NVIDIA Sentry: Secure AI Agents at Runtime” (October 21, 2026) — NVIDIA’s description of DOCA Tower, DOCA Argus, Open Policy Agent policies, containment on BlueField-4, tamper-evident records and the planned availability.