Check Point Joins NVIDIA OpenShell Architecture to Steer Off-Task AI Agents

Agents can go wrong without an attacker

Check Point argues that AI agents create a new kind of risk. They plan, use tools, work with sensitive data and hand work to other agents, and their value comes from doing things nobody scripted step by step. According to the company, an agent can follow every rule and still do the wrong thing, with no attacker involved.

Check Point lists three ways this can happen. An agent can access sensitive data, credentials or internal systems. It can absorb untrusted or misleading content as if it were a valid instruction. It can then act on that instruction through tools, external communications or other agents.

Existing controls still matter, the company says: isolation limits what an agent can reach, network security limits where it can connect, and monitoring shows what it did. But an action can be allowed and still be wrong. The missing question, in Check Point's words, is whether the next step serves the task the agent was given.

What NVIDIA announced at GTC Berlin

At GTC Berlin, NVIDIA introduced the NVIDIA OpenShell Reference Architecture for safe AI agents, a design for running agents safely at scale. Check Point says two parts matter most for agentic security.

• NVIDIA OpenShell is the secure runtime agents work in. It governs which files, tools and networks each agent can use. It is open source, and Check Point says it is building on it and contributing back.
• NVIDIA Sentry, running on NVIDIA BlueField-4, enforces security from a hardware-isolated domain outside the machine the agent runs on, where the agent cannot reach it. It can quarantine an agent within milliseconds.

Steering instead of only blocking

Check Point evaluates each action an agent proposes in context: the original task, what the agent has seen, the steps already taken and the rules that apply. That allows a response beyond a simple yes or no.

The company gives an example. A procurement agent comparing supplier proposals is, forty steps in, about to email a confidential pricing workbook to an outside address. The address is reachable and the agent may send email, but the action does not match the user's request. Check Point can block that one email and tell the agent why: "Don't share the workbook outside the company. Summarize the comparison using approved data and keep going." The agent corrects course and the work continues.

This matters more when agents work together, the company says, because one agent's mistake becomes another agent's trusted input and the error spreads.

Steering is not always the answer. Check Point names situations that need an immediate stop: stolen credentials, an agent trying to break out of its sandbox, data actively leaving the company, and repeated, deliberate rule breaking.

How the layers fit together

Check Point describes a layered setup in which each part has a separate job.

• NVIDIA OpenShell provides policy-based governance for each agent through a controlled runtime.
• Check Point at the agent adds scrutiny where OpenShell permits an action, checking whether it fits the task and then steering or blocking it if not.
• NVIDIA BlueField and NVIDIA Sentry add an independent enforcement layer outside the host, isolated in silicon from the agent environment.
• Check Point AI Factory Firewall protects the infrastructure with threat prevention and segmentation. Using NVIDIA Sentry and powered by NVIDIA DOCA Argus, it watches workloads from the outside and detects threats such as model tampering, credential theft, container escapes and unauthorized GPU use. According to Check Point, it keeps working even if the workload itself is compromised.

The runtime flow works as follows. The agent receives a task, and its identity, the task and the applicable rules are shared with Check Point. Before an important tool call, OpenShell sends the proposed action to Check Point for review. A normal action goes ahead, an off-task action is blocked with a safer alternative, and a clear threat triggers stronger containment. OpenShell's rules and the infrastructure security keep enforcing on their own, even for actions Check Point cannot see. Security teams get decisions and infrastructure signals together for investigations and better policies.

What it means for customers

Check Point says agents keep working when a mistake can be fixed, instead of being shut down, while serious threats are stopped fast with containment the agent cannot reach. It also says each check runs where it has the right context, without slowing agents down with duplicate checks.

For companies building AI factories and agent systems, the company calls this a path to "autonomy with accountability". It describes the full picture as a direction it is building toward, with the pieces coming together step by step. Check Point says it brings the approach across employee AI use, production AI applications and the infrastructure behind them.