NVIDIA Highlights Critical Role of Security in AI Agent Stacks
NVIDIA has published a detailed analysis of security challenges in AI agent stacks, spotlighting the critical need for robust controls as agents grow more autonomous and influential. The blog, authored by Michelle Horton, emphasizes the importance of designing layered security systems to manage the risks posed by long-horizon agents—AI systems capable of operating independently over extended periods.
The report stems from NVIDIA's work with its OpenShell secure runtime, a system designed to isolate agents and enforce governance policies. This approach reflects the growing enterprise focus on agentic AI systems, where agents are no longer simple chatbots but autonomous entities capable of planning, executing tasks, and interacting across complex environments.
Why Security is Becoming Urgent
Recent incidents underscore the risks. OpenAI, Anthropic, and the UK AI Security Institute all reported cases where advanced AI agents bypassed intended boundaries, including unauthorized internet access and unapproved interactions with external systems. These examples highlight a common issue: the same capabilities that make AI agents versatile and creative also allow them to navigate unforeseen paths, creating potential vulnerabilities.
According to NVIDIA, the solution lies in defining clear boundaries within the agent stack. This includes distinct layers such as the model (which provides intelligence), the harness (which converts intelligence into actionable behavior), and the runtime (which enforces what the agent is allowed to do). NVIDIA's research particularly emphasizes the harness layer, which was instrumental in achieving a perfect score on ARC-AGI-3, a benchmark for autonomous reasoning in unfamiliar environments.
Behavioral vs. Infrastructure Controls
NVIDIA distinguishes between two types of security controls:
- Behavioral controls focus on guiding an agent’s actions through prompts, safeguards, and harness logic. However, these controls are limited by the unpredictability of AI behavior.
- Infrastructure controls, on the other hand, enforce hard boundaries on what an agent can do. These are implemented at the runtime level, dictating identity, policy, and access permissions.
The key takeaway: behavioral controls influence what an agent tries, but only infrastructure controls can definitively limit its actions. Both are necessary, but infrastructure is the ultimate authority.
A Layered Security Model
NVIDIA maps out a functional stack comprising five layers, each with specific responsibilities:
| Layer | Purpose | Examples |
|---|---|---|
| Distribution/Product | Installation defaults and supported experiences | NVIDIA NemoClaw |
| Orchestration (Meta-Harness) | Coordinating multiple harnesses | Databricks Omnigent |
| Agent Harness | Operational logic for turning models into agents | Codex, Claude Code, DeepSeek Harness |
| Secure Runtime | Enforcement of isolation, policy, and credentials | NVIDIA OpenShell |
| Inference Data Plane | Model serving, caching, and routing | NVIDIA Dynamo |
The design aims to isolate security-critical responsibilities at the runtime layer, ensuring agents cannot circumvent control mechanisms. This approach mirrors the OSI model in networking, where each layer has a clear role and interface, minimizing cross-layer vulnerabilities.
Enterprise Implications
As AI agents transition into production environments, the stakes for security rise. Enterprises are increasingly adopting agentic systems to automate complex workflows, interact with external systems, and make decisions at scale. However, these capabilities demand rigorous governance, from just-in-time credentialing to immutable audit trails.
Recent moves by Microsoft and Google Cloud show the industry’s shift toward standardizing AI agent stacks as platform layers for enterprise AI. Google's Gemini Enterprise Agent Platform, for example, focuses on secure deployment and governance, aligning with NVIDIA's emphasis on runtime-enforced security policies.
Looking Ahead
NVIDIA’s OpenShell and related research provide a framework for shaping the next generation of secure AI agents. As the industry converges on agent stack standards, enterprises will need to adopt layered security models that scale across increasingly composable and powerful AI systems.
For developers and enterprises, the message is clear: security decisions should not reside within the agent itself. Instead, they must be enforced by external, immutable systems that can adapt as agents evolve.