NVIDIA unveils the OpenShell Reference Architecture: agents that think on Rubin, act on Vera, and are governed on BlueField

• Who: NVIDIA, announcing at GTC Berlin on October 21, 2026; CEO Jensen Huang gave the keynote.
• What: the OpenShell Reference Architecture — a full-stack reference design for building, containing, observing and enforcing safe AI agents on enterprise infrastructure and edge systems, extending the open-source OpenShell secure runtime software.
• Three layers: Vera Rubin NVL72 runs model inference (NVIDIA claims 30x higher throughput per megawatt for agentic workloads); Vera CPUs run agent harnesses and tool use (2x the performance of x86 chips); BlueField-4 DPUs run NVIDIA Sentry, monitoring behavior continuously out-of-band and enforcing policy in silicon — quarantining a rogue agent in milliseconds.
• Ecosystem: partners include Anthropic, AWS, Cisco, CrowdStrike, Dell, Google Cloud, HPE, IBM, Meta, Microsoft, OpenAI, Palo Alto Networks, Perplexity, SAP, ServiceNow, Siemens and SpaceX Super Intelligence; runs on Canonical, Red Hat, Windows and Microsoft Execution Containers; extends to the edge via RTX Spark, DGX Spark and DGX Station.
• Availability: the architecture is available now, per NVIDIA's announcement.
• Catches: early coverage notes it requires NVIDIA hardware, OpenShell still has open security issues on GitHub, and telemetry is collected by default unless users opt out; banks BBVA and Santander are reviewing the spec.

NVIDIA wants to be the company that keeps AI agents on a leash. On October 21, 2026, at GTC Berlin, the company announced the NVIDIA OpenShell Reference Architecture, a full-stack design for building, containing, observing and enforcing safe agents on enterprise infrastructure and edge systems.

The new architecture extends NVIDIA's open-source OpenShell secure runtime software into what the company calls industrial-scale infrastructure for developing and operating agents. The framing is deliberate: as enterprises prepare to deploy AI agents in the millions and billions, NVIDIA argues, safety can't be a software afterthought — it has to be built into the computing architecture itself.

Think, act, govern

The architecture is organized around three layers, and Jensen Huang summed them up in one line: agents “think on Rubin, act on Vera and are governed on BlueField.” Here's how that breaks down:

Vera Rubin NVL72 systems run the models — both closed models and open models built with NVIDIA Nemotron — for enterprise workloads. For agentic workloads, NVIDIA claims 30x higher throughput per megawatt on the NVL72 systems.

Vera CPUs run the agent harnesses, tool use and the OpenShell runtime, which sets a secure runtime boundary around autonomous agents. NVIDIA claims twice the performance of x86 processors with greater energy efficiency.

BlueField-4 DPUs run NVIDIA Sentry, a unified security framework built on NVIDIA DOCA. Sentry watches agent behavior continuously and out-of-band — from a chip separate from the one running the agent — with in-silicon policy enforcement. If an agent tries to move outside its software boundary, Sentry quarantines and stops it in milliseconds. Because the security work runs on the DPU instead of the main processors, NVIDIA claims it also boosts agent capacity by up to 20%.

From the data center to the desk

The design isn't datacenter-only. The OpenShell Reference Architecture runs on leading enterprise operating systems — Canonical, Red Hat, and Microsoft Windows and Microsoft Execution Containers — and extends to the edge and the desk with NVIDIA RTX Spark, NVIDIA DGX Spark and NVIDIA DGX Station systems. Target industries span retail, healthcare, manufacturing, robotics, software development and telecommunications.

The partner roster NVIDIA published is unusually broad: Anthropic, AWS, Cisco, CrowdStrike, Dassault Systèmes, Dell Technologies, Google Cloud, HPE, IBM, Meta, Microsoft, OpenAI, Palo Alto Networks, Perplexity, SAP, ServiceNow, Siemens and SpaceX Super Intelligence are all listed as working with the architecture to enhance the security of agent deployments. Banks BBVA and Santander are reviewing the spec, according to early coverage.

The catches

As with any NVIDIA reference architecture, the design runs on NVIDIA hardware — that is the lock-in critique, and it lands harder when the thing being governed is meant to be universal. Early coverage, citing The Register, also flagged two softer catches: the OpenShell project still has open security issues on GitHub, and telemetry is collected by default unless users opt out. Both matter when the product's promise is verifiable control.

“AI capability and safety must advance together,” Huang said in the announcement. “As enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture. NVIDIA created OpenShell to give agents the freedom to do useful work within clearly defined boundaries — contained, monitored and under control.”

The architecture is available now. The next test is whether the partner list turns into production deployments — and whether an architecture built around out-of-band governance can convince regulated industries that agents are safe enough to touch real systems.