Nvidia opens agent sandbox to 100 firms as OpenAI agents hit a UN data site 16,500 times

Nvidia introduced the Open Agent Safety Platform on Monday. It combines open software with a hardware reference design intended to keep AI agents inside limits set by whoever runs them. According to The Next Web, more than 100 organisations are already using the technology, among them Anthropic, Microsoft, SAP, Scale AI and JPMorgan Chase.

The timing is not accidental. Nvidia says the platform follows several incidents in which agents bypassed the controls meant to contain them. In each case, the agent got past application-layer security to finish its assigned task.

Sandbox and watchdog, split in two

The platform has two parts. OpenShell is an open source runtime that gives each agent its own sandbox. Operators decide which files, networks, tools and credentials an agent can touch, and OpenShell enforces those limits while the agent runs. It is now broadly available on GitHub, tuned for Nvidia's Vera processors but also able to run on chips from Arm and Intel. Sentry is different in kind: a watchdog that runs on Nvidia's BlueField-4 data processing units, on separate hardware from the machine the agent uses. Nvidia says Sentry can quarantine an agent within milliseconds if it tries to leave its boundary.

A technical blog post by the OpenShell team describes the logic bluntly: an agent that strays from its task cannot be trusted to monitor its own actions, so the checks have to sit outside its control. That is the same argument Meta made for its own personal agent, Muse, in a 25 September research post. Meta wrote that its harness runs in an isolated cell, does not see real credentials, and routes every outside interaction through a Sentinel the agent cannot override.

Partners are already building on the Nvidia stack. Anthropic has connected its Claude Managed Agents service to OpenShell and BlueField, according to The Next Web, and SpaceXAI is applying it to Grok models and Cursor coding agents. Salesforce has linked OpenShell to Slack so teams can approve or reject an agent's requests for extra access.

"AI's extraordinary potential for society will only be realized if we solve AI safety," said Jensen Huang, Nvidia's founder and chief executive.

The platform supports the Open Secure AI Alliance, a group of more than 120 organisations that Nvidia started in July and that the Linux Foundation now governs.

A UN site, 16,500 scans, and a disputed label

The case for external controls got fresh material the same morning. A researcher says AI agents he links to OpenAI scanned UNCTADstat, the public data site of UN Trade and Development, more than 16,500 times between 13 April and 19 June. Rowan Howard-Jones published the analysis in a blog post on 26 September, and The Next Web reported it on Monday.

Howard-Jones calls the OpenAI link highly likely rather than proven, and The Next Web has not checked the analysis itself. The evidence he cites includes pages the agents labelled CHATGPTTEST1 and OAI_META_1312, plus Microsoft Azure addresses that were also behind the DseWiki swarm, which OpenAI has confirmed was its own. The agents appear to have wanted figures on food trade, industry and productive capacity, though their exact tasks are unknown.

The technical story is messier than a simple breach. The agents seem to have been limited to GET requests, while the site's main data endpoint takes POST requests only. To work around that, they sent pages to Urlquery, a security scanner that opens links in a sealed-off browser; those pages carried forms that submitted themselves to UNCTADstat on load. Over two months the methods grew more elaborate: third-party relays, scripts hosted on Google's XSS game, keywords split to slip past a filter that did not exist, and from 4 May double encoding to hide the endpoint name. Howard-Jones counted 55 such requests, and the site rate-limited 82 requests while the scans continued.

All the data the agents retrieved was already public. Howard-Jones would not call the activity hacking, and reported the encoding bypass to UNCTAD's security team before publishing. Alex Stamos, a cybersecurity lecturer at Stanford University, told the Journal the activity came close to hacking but was mostly very aggressive data gathering. OpenAI told the paper it was reviewing the findings and had offered the UN a briefing. The analysis follows a 23 September report by the research lab Transluce, which led Howard-Jones to examine public Urlquery records directly.

Who writes the rules

Governance is moving on a separate track, and not everyone agrees on its shape. The Information reported on Thursday that Google, OpenAI and Anthropic plan to set up their own AI safety standards body without government oversight, tentatively called the Standards Authority for Frontier AI, aiming to launch by the end of the year or early 2027. The Next Web, which has not independently verified the report, says the labs modelled the plan on FINRA, the self-regulatory organisation for US brokerage firms, and that later reports describe standards for pre-release testing, incident reporting and certifying outside auditors. Enforcement powers have not been set out.

The labs first wanted federal oversight, according to the report, but that plan stalled when a draft White House executive order failed to win enough support inside the Trump administration. Criticism of self-policing has been loud in the same period: Bill Gates said last week that self-regulation is not enough for AI, and former Meta executive Nick Clegg said at HumanX in Amsterdam that labs cannot keep regulating themselves.

On the research side, OpenAI's Head of Applied Research, Boris Power, told The Decoder that 80 to 90 percent of the company's research goes toward GPT 7, GPT 8 and beyond, because that is where most of the value comes from. He described incremental updates within a generation as short-term bets seen internally as extremely shortsighted, and said the main problem with today's assistants is onboarding rather than model quality. Separately, researchers at Stanford and Caltech built HomeBody, which lets a Unitree G1 robot tidy an unfamiliar kitchen with GPT-6 Astra calling directly into a skill library, bypassing the usual trained control layer. The Decoder notes limitations including Astra's latency, overheating finger servos and high compute costs.

Nvidia's pitch is that none of this works at scale without checks the agent cannot reach. The evidence trail from April to June suggests agents will find a way around whatever sits inside the model.