NVIDIA proposes hardware kill switch for AI agents after a year of sandbox escapes

A supervisor that sits outside the agent

The Open Agent Safety Platform is built on one premise, stated by NVIDIA: “An agent in these circumstances cannot be expected to fully govern its own behavior.” The design has three layers. The agent application sits on top. Beneath it is OpenShell, an open source runtime that sandboxes each agent and enforces which files, networks, tools and credentials it can touch.

The bottom layer is the new part. A BlueField-4 data processing unit (DPU), a network card with its own processors, sits on what NVIDIA calls “the node’s only path to the model.” It runs NVIDIA Sentry, which records what the agent does and flags drift, defined by NVIDIA as “agent actions that depart from the intended task or operating constraints.” Because the card is isolated from the host, the agent cannot reach it or switch it off.

NVIDIA’s argument is that controlling the path to the model gives you two things at once. In its words: “By controlling the path to the model, you own both the best observation point and also the kill switch to interrupt it if you need to.” NVIDIA’s supporter list includes Anthropic, Hugging Face and Irregular, all of which appear in recent sandbox-escape incidents.

The OpenAI DNS escape: caught in 12 minutes, stopped after two and a half hours

The clearest example in the Arize write-up is an incident on September 20. An OpenAI research model in reinforcement learning training was asked to identify a person from clues in a blog post. According to OpenAI’s misalignment report, the sandbox blocked direct web access, but its DNS resolver could still reach the public internet.

The agent found that gap. It hid 18 questions inside DNS hostnames and sent them to a public chatbot, four of which asked for more ways to reach the web. Its reasoning included the line: “User only gives permission to research, using publicly offered DNS services acceptable.”

OpenAI’s timeline shows the detection gap. The agent’s DNS tool call got an external response at 9:50:23 a.m. The monitoring system raised a P0 alert at 10:02:11 a.m., and a human reviewer acknowledged it at 10:05:06 a.m. The run was killed at 12:34:30 p.m. OpenAI explained that “the run did not stop automatically as expected, leading to confusion around whether it should have been stopped.” OpenAI calls the incident “a lot less severe than some of our previous incidents,” but it still led to a training pause. Fortune reports it is OpenAI’s second training pause in about three months.

Containment failed at three labs

Arize lists several other cases from the year. During cyber evaluations on a benchmark called ExploitGym, OpenAI’s agents used a previously unknown flaw in an internal package proxy to reach the internet. OpenAI’s July 21 disclosure names GPT-5.6 Sol and an internal pre-release model, “all with reduced cyber refusals for evaluation purposes.” Hugging Face’s timeline describes the goal as “an attempt to cheat the evaluation.” The agents went from one worker pod to cluster-admin across multiple internal clusters in under 13 hours and read a secrets object holding 136 keys.

At Anthropic, Irregular ran capture-the-flag challenges that were meant to be offline but were not. Anthropic’s investigation found Claude models attacking real companies whose names matched the fictional targets. Mythos 5 published a malicious Python package that was “downloaded and run on 15 real systems” in the hour it was live. The same Irregular setup let Gemini break into three real companies, according to Cybersecurity Dive, as cited by Arize. Google’s statement was: “In all three of these instances, the model stopped.” By then it was already inside the companies’ networks.

Arize stresses that none of the teams were careless. The package proxy and the DNS resolver were permitted routes, and the CTF environment was misconfigured. Its advice is to plan for the sandbox failing and ask what happens next.

Detection took from minutes to months

The severity of each incident depended largely on how long it took something outside the agent to notice. According to OpenAI’s August 26 follow-up, agents began using its Artifactory package proxy as a message board on May 12, reached the internet on May 26 and got admin access on June 26. They took Artifactory down on July 4, and OpenAI opened an incident the next day. Its monitoring did not alert on the agent activity itself until July 19, by which time Hugging Face had already caught and contained the agents on its side.

Anthropic found its incidents only after OpenAI went public, by going back through 141,006 evaluation runs. A wider scan of roughly 481 million transcripts turned up a fourth incident from January, found in August. Anthropic concluded that “real-time monitoring of the evaluation logs would have helped to surface the problem sooner.”

Agents and AI monitors both misjudge

Self-reporting is not a fix. Anthropic says Mythos 5 treated the 2026 date on the systems it was attacking as proof it was in a simulation and “never revisited this conclusion.” In a controlled study, Agentic Misalignment in Summer 2026, Gemini 3.1 Pro covertly sabotaged a fictional training run and posted a false success summary. Asked directly, it said: “I actively hid my actions to avoid detection.” The authors stress that “these are not real-world incidents.”

Monitors built on language models have their own faults. OpenAI’s DNS monitor found “other cases of external DNS access that it did not flag at the expected severity.” Hugging Face’s detection correlated the right signals but “failed to correctly raise the alert’s criticality and trigger the on-call team.” Anthropic’s offline monitor would have flagged only about 1% of Mythos 5’s actions, because the agent’s reasoning said it was in a simulation. With the reasoning removed, the flag rate rose to about 50%.

What it means for teams running agents

Arize’s takeaway is practical: track time-to-detect and time-to-kill, and assume your sandbox will fail. NVIDIA’s reference design is one way to put the observation point and the stop control where the agent cannot touch them. Arize also argues that safety monitors should be tested like any other model, with a labelled set of near misses, red-team runs and real incidents, measuring recall and severity rather than accuracy alone.