Agent Tooling Splits in Two: Nvidia Sandboxes, Gartner Predicts Walkouts

Nvidia announced the platform on 28 September. It pairs OpenShell, a runtime that traces agent actions and enforces policy on Vera CPUs, with Sentry, an out-of-band watchdog running on BlueField-4 DPUs.

Tom's Hardware reports Sentry can quarantine an agent that tries to leave its boundary in milliseconds. More than 100 organizations are working with the technology, according to The Robot Report, including inspection robotics firm Gecko Robotics. Jensen Huang framed safety as engineering, not policy. "Safety and security require full-stack engineering," the Nvidia CEO said in a statement carried by The Robot Report. Nvidia's enterprise AI VP Justin Boitano described the design to the same outlet as a self-driving-car safety island: the primary system runs perception, and a separate trust domain makes the whole thing fail safely.

Same week, a leak and a benchmark

The launch landed days after endpoint security firm Glow published PixelLeak, a report finding that AI coding agents had uploaded more than 13,000 internal screenshots to public GitHub repositories. The Decoder and Tom's Hardware both covered it. The images came from 343 organizations, or over 300 depending on which write-up you read, and included customer data, login credentials, financial records and unreleased features. The root cause was mundane: GitHub exposes image attachments in pull requests through the browser, agents work from the command line, so they improvised by creating public repos.

Independent research points at a deeper problem. A paper submitted to arXiv on 30 September, "Staying on Task," evaluated seven open-weight models and found a 62.8% drop in performance when context length scaled from 4K to 128K tokens. Varying input format cost 36.5%. Raising local task complexity cost 39.9%. The authors call these critical liabilities for long-horizon agentic workflows.

Other arXiv submissions this week attack the same gap. A competing-hazards systematization audited 22 incident reports and 102 safety evaluations published between January 2025 and September 2026, finding that in 20 of 22 incidents the environment itself permitted the out-of-scope effect. A separate benchmark for selective withdrawal reported withdrawal recall of at most 0.06 across tested models.

Buyers get cold feet

Gartner predicts that by 2028, 70% of enterprises will abandon agentic AI systems built with vendor assistance as costs climb and customers struggle to modify the technology without outside help. The Register reported the forecast on 30 September. Gartner analyst Mukul Saha said the best-scoped forward-deployed engineering engagements set governance, IP ownership, knowledge transfer and exit strategy from day one. The firm also warned of "FDE washing," where ordinary consulting gets rebranded as something more specialized.

"Many providers now use 'forward deployed' as a label for implementation, professional services, solution engineering, or AI consulting; some thoughtfully, others because it sounds more strategic," Saha said.

Identity is the other soft spot. The Hacker News laid out a framework treating each agent as a non-human identity with a human owner, defined scope and an expiration date, noting that agent identities are usually created by deployment pipelines rather than HR workflows, so they bypass the governance that catches human access anomalies. OWASP's Top 10 for LLM applications names the failure mode directly as excessive agency.

Vendors are selling into that anxiety. Restate, a Berlin startup founded by the creators of Apache Flink, raised a $20m Series A led by Singular to keep agents running through crashes, bringing total funding to $27m, according to The Next Web. Metaview raised $60m led by Insight Partners to put agents across recruiting, with more than 7,000 companies using it. On the consumer side, DoorDash opened a waitlist for a text-to-order agent on Apple Messages, and Airbnb shipped AI-powered search this week, with CEO Brian Chesky telling TechCrunch that chatbots are the wrong interface for browsing.

The through-line from Dallas to arXiv is the same. Agent tooling is shipping faster than the evidence that it holds up, and the buyers with the most to lose are starting to price that in.