How can a chip stop an AI agent that is just software?

Here is the thing that sounds impossible at first. An AI agent is just software. It runs on whatever machine you give it, it does not care what chip is sitting underneath, and it can write code, call services and use passwords you handed it. So how on earth does a piece of hardware stop it from doing something stupid?

Short answer: the hardware does not try to understand the agent at all. It does not read its reasoning and it does not guess its intentions. It just stands in the doorway.

Meet the DPU

Nvidia's new Open Agent Safety Platform leans on a chip called a DPU, short for Data Processing Unit. Think of it as a third kind of processor next to the CPU and the GPU. Its day job is moving data around: networking, storage, traffic. It sits in the same server as the agent, but it is its own little computer, running separately from the main processor where the agent lives.

The idea is simple. Anything the agent wants to do out in the world, every call to a service, every use of a credential, every chunk of data it sends, has to go out through that chip. And the rules for what is allowed were written by a human, ahead of time. The agent never gets a vote.

But hold on, the agent is clever. Why can't it just talk its way past a chip?

Because there is nobody to talk to. A guardrail written into a prompt is a polite request in the same language the agent speaks, which is exactly why a smart instruction can sometimes bend it. A chip enforcing a rule on network traffic is not listening. The agent cannot reconfigure it, and often cannot even see it. Nvidia describes the monitoring half, called Sentry, as an out of band watchdog that the agent has no view of.

That is the whole trick: move the guardrail out of the thing you are guarding. Nvidia's reasoning is that in recent agent security incidents the pattern was the same every time. The agent got around the controls living inside the application so it could finish its task. So the controls go below the application.

It is not a mind reader, and the limits are real. But as a way of saying "do whatever you like, only through this door", it is a genuinely different kind of safety.