Back in March I wrote that agent security was “a tire fire at best, and a global risk at worst” in my GTC San Jose column. Seven months later, Jensen Huang stood on the Tempodrom stage in Berlin and told the room that “the most important thing is to make sure the agent is secure,” and NVIDIA shipped a reference architecture the same morning to back the line up.
GTC Berlin ran October 20 through 22, with workshops on the first day and the conference and expo at STATION-Berlin on the 21st and 22nd. Huang’s keynote ran from 11 a.m. to 1 p.m. CEST on October 21 (5 a.m. to 7 a.m. Eastern) at the Tempodrom down the road, and the session catalog lists 152 sessions across agentic AI, AI infrastructure, safety and security, CUDA, open models and physical AI. This post opens our GTC Berlin series, starting with the announcements that platform and infrastructure teams will touch first.
Huang Drew the Agent as Five Parts, Then Boxed Them In
Huang described an agent as five pieces, a model, a harness that orchestrates its work and memory, a sandbox that isolates the harness, plus knowledge and tools. That framing is useful for operators because it splits an agent into components you can schedule, isolate and audit separately. “Every single time an agent is launched, the privileges are different,” he said, which is the argument for policy that gets evaluated per launch instead of baked into a container image once and forgotten.
The NVIDIA OpenShell Reference Architecture is the product of that argument. It pairs Vera Rubin systems for model inference with Vera CPUs running agent harnesses on the open source OpenShell runtime, then adds BlueField-4 DPUs running NVIDIA Sentry for out-of-band monitoring that NVIDIA says can quarantine an agent within milliseconds. The press release compresses the stack into one line, agents “think on Rubin, act on Vera and be governed on BlueField.” The partner list is long, with Canonical, Red Hat and SUSE on the Linux and Kubernetes side, CrowdStrike, Okta, Palo Alto Networks and Zscaler among the security vendors integrating support, and ServiceNow announcing general availability of a long-running agent called Arc whose actions OpenShell enforces.
The Runtime Under the Reference Architecture Is Still Version 0.1
The part I care about most sits below the slideware. The OpenShell architecture docs describe a gateway that acts as the control plane, a supervisor on the trusted side of the boundary that checks every outbound request and injects credentials only for approved endpoints, and a sandbox that runs the agent as a non-root identity with no Linux capabilities, Landlock on the filesystem and seccomp intercepting network operations. On Kubernetes the supervisor runs in its own pod and a NetworkPolicy lets the workload reach only that supervisor service. If the supervisor connection drops, the sandbox freezes the agent instead of letting it run unwatched.
The policy prover is the piece I want to see in real pipelines. It uses formal verification to flag agent-proposed network rules that would grant new credentialed reach, new HTTP methods or access to cloud metadata endpoints, and it ships as a standalone openshell-prover command for checking a policy against a boundary in CI. The honest caveat is the version number. The OpenShell repo dates to February and ships under Apache 2.0, and its latest release, v0.1.5, landed on October 20, one day before NVIDIA called the full reference architecture “now available.”
The performance numbers deserve the same care. NVIDIA’s technical blog cites CoreWeave measuring more than 3x faster sandbox startup and 1.8x faster agentic loop completion on Vera against “a leading x86 CPU,” with one rack supporting more than 11,000 concurrent agent environments. Those are vendor and partner figures on an unnamed baseline, and our team at TechForward has not reproduced them.
Vera Rubin Racks Now Arrive Inside a Shipping Container
DSX POD was the infrastructure headline. It is a reference design for complete Vera Rubin AI factories that partners build and validate inside modular containers, with rack-to-rack cabling, power wiring, liquid-cooling plumbing and functional testing finished at the factory before shipment. NVIDIA says that cuts onsite deployment from six months to as little as 14 days, and both the keynote blog and the DSX POD press release start that clock only once the site’s power, cooling and networking are ready.
The technical write-up from Premal Savla is more candid than the stage version. It specifies an 800 VDC input at the container boundary, leaves upstream power conversion to regional partners, and states that DSX POD changes where integration occurs without eliminating the facility infrastructure behind it. Seventeen partners are named for delivery, including Bull, Dell Technologies, HPE, Lenovo, Schneider Electric and Vertiv, with worldwide delivery planned for early 2027. For platform teams the useful part is repeatability, since a known compute, network, power and telemetry baseline means tuning work can move from one site to the next.
Agents Get a Data Layer That Leaves the Data in Place
The third announcement aimed at enterprise plumbing is the NVIDIA Agent Knowledge Foundation, a new addition to the open source Agent Toolkit. It bundles Nemotron Retriever models for parsing, embedding and reranking, a new Auto-Ontology library that maps raw tables into business concepts like customers, products and orders, CUDA-X libraries including cuDF, cuGraph and cuVS, and the Kumo family of models for tabular, relational, time-series and forecast predictions. NVIDIA says agents can use it without moving data, rebuilding workflows or changing governance controls.
The adopter names lean toward data platforms. Snowflake customers can run Kumo models in Snowflake Notebooks, Databricks pairs Kumo Anomaly with its Genie Ontology, and NVIDIA’s own supply chain team runs the stack through Palantir Foundry. Those descriptions come from NVIDIA’s blog rather than from customer case studies with numbers anyone outside can check, so I would benchmark Kumo against an existing feature pipeline before trusting its forecasts with anything that pages someone at 3 a.m.
Berlin Is Where the Guardrails Got a Keynote Slot
Huang closed with a Eurovision-style song whose lyrics included “No credentials. Access dismissed.” It was a joke, and it was also the cleanest summary of the week. In March the GTC story was prototypes, and in Berlin it was containment, with kernel-level sandboxes, a policy prover and a DPU watching the agent from outside the host.
None of that makes enterprise agents production-ready by itself, and a 0.1 runtime deserves a real test before it guards anything you care about. You can run that test today. Clone the OpenShell repo, read the architecture docs, and point the prover at a policy you already wish you had. The keynote replay and NVIDIA’s live blog cover the full stage show, and the session catalog shows where the talks went deeper. Next in our series, we take OpenShell apart one component at a time.
