VAST Data and NVIDIA unveil a sandbox blueprint for governed AI agents

Why sandboxes matter for agents

VAST argues that large enterprises, tech companies and other security-conscious organizations are holding AI agents back rather than rushing them into production. The company compares agents to human employees who are given a task without every step being specified, but notes that agents lack accountability. There is no concern about repercussions if their actions hurt the business, and the only option is to try to unwind the damage.

Agents can also multiply quickly. In VAST's words, one agent today could become 1,000 agents tomorrow. The company says agent sandboxes are quickly becoming the de facto approach for guardrails, meant to stop agents from going rogue and to limit the blast radius of questionable actions while still giving them the tools they need.

What the Foundation Stack contains

VAST describes the stack as the result of its continued collaboration with NVIDIA. It has four main parts:

• NVIDIA NemoClaw provides blueprints for building, deploying and operating agents. It supports Hermes, LangChain, OpenClaw or custom agent harnesses.
• NVIDIA OpenShell is the secure runtime. It uses an identity-based approach to enforce access and behavior policies and logs every interaction between an agent and the world outside its sandbox.
• NVIDIA Sentry is an extra layer of defense for organizations deploying the NVIDIA Vera Rubin platform. It uses onboard NVIDIA BlueField-4 DPUs for real-time monitoring and security between agents on NVIDIA Vera CPUs and models on NVIDIA Rubin GPUs, as well as other external systems.
• VAST AI OS supplies the infrastructure to run agents at scale and extends security controls into the data layer, with a focus on observability and auditing, AI-native storage and operational data services.

How the pieces work together

VAST lays out a twelve-step lifecycle. OpenShell sets the security rules and provides kernel-level sandbox isolation, while VAST AI OS powers the operational layer underneath. VAST DataStore's Block CSI uses zero-copy clones to provision OpenShell sandboxes in seconds. VAST DataBase acts as a shared vector store and knowledge base, so hundreds of reasoning agents can query the same dataset concurrently without data sprawl.

DataStore also offers isolated, persistent volumes that let agents suspend and resume using snapshots and clones, plus dedicated workspaces and shared storage for objects and files. The VAST Management System provides real-time data-layer telemetry that works with NVIDIA Sentry. When Sentry flags or quarantines a misbehaving agent, VAST says the AI OS isolates data access and freezes the sandbox state for immediate forensic review. OpenShell enforces governance, and VAST DataBase records every tool call, prompt, token, cost and decision as an immutable audit trail.

For the work itself, VAST says agents can access permitted data in real time, whether objects and files in DataStore or tables and vectors in DataBase. VAST DataEngine, SyncEngine and EventBroker support full data pipelines, including real-time ETL, multi-modal analytics and long-term, high-fidelity data retention, so agents can run compute functions or whole inference workflows as new data arrives.

What it means for enterprises

VAST positions the stack as a deployable blueprint for bringing agents into production without giving up security or operational control. The company says agents operating without strict boundaries, robust memory and granular data governance will be a liability rather than a scalable business asset.

The stack builds on the recently announced VAST DataEnclave, which VAST says offers a trusted, cryptographically secured runtime for running leading commercial AI models alongside sensitive data on customer-controlled infrastructure. Together, VAST says, they add trust and control across data, models and agents. A preview of the Foundation Stack is available through VAST, and the company published a demonstration of a fleet of agents assessing strategic business opportunities, showing sandbox creation, event logging and human-in-the-loop approvals. The source gives no details on pricing or general availability.