{"resourceId":"anomity-oas-containment-gap-20261002","versions":[{"version":"external-a64b9a51c62c4e825e31f4fdf80e8fc8fd81688fe4d3191322dd0b7554d409e6","resource":{"id":"anomity-oas-containment-gap-20261002","title":"Anomity: Open Agent Safety puts controls outside the agent—now count agents outside it","organization":"Anomity Research","sector":"AI agent security / independent analysis","geography":"Global (U.S.-facing vendor security blog)","publishedAt":"2026-10-02T00:00:00Z","publicationDate":"2026-10-02","eventDate":"2026-10-02","sourceName":"Anomity","sourceLabel":"Independent scrutiny / containment-gap analysis","sourceUrl":"https://anomity.ai/blog/nvidia-open-agent-safety-platform-openshell-sentry/","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["developers-agents","data-security","governance-procurement","operating-model"],"finding":"Oct 2, 2026 Anomity analysis of NVIDIA’s Sep 28 Open Agent Safety Platform restates OpenShell (sandbox + supervisor policy, credentials outside workload, OCSF) and optional Sentry on BlueField-4 for Vera/BlueField data-center systems, citing 100+ organizations working with the stack (Anthropic, Salesforce, SAP, Red Hat, SUSE, Canonical). The core new operating claim: OpenShell and Sentry do not see coding agents installed natively on laptops, desktop assistants adopted ad hoc, or MCP servers started from READMEs—and on most fleets those are the majority. Anomity cites its prior containment-gap survey framing (46 of 57 enterprises that solved agent identity had never built isolation) as why a free sandbox alone does not close the program.","sledRelevance":"Warns SLED buyers that Open Agent Safety adoption metrics that count only sandboxed agents will miss shadow agents on unmanaged endpoints—critical for higher-ed and agency laptop-heavy fleets.","evidence":"Opened Anomity Insights post dated Oct 2, 2026. TL;DR and body explicitly separate OpenShell/Sentry coverage from native endpoint agents and reference containment-gap survey counts.","architectureImplications":"Pair OpenShell enrollment with endpoint inventory of agents/MCP/CLIs; do not treat DPU Sentry attach as a substitute for endpoint discovery.","governanceImplications":"Define success as covered agents over discovered agents; require inventory tooling or MDM/EDR hooks in the same program as OpenShell.","securityPrivacyImplications":"Residual risk concentrates on unmanaged developer machines and MCP servers outside the sandbox; Sentry’s data-center scope does not remediate that.","caveats":"Anomity sells complementary endpoint inventory/governance; survey figures are Anomity’s prior research, not a new independent third-party study in this post; not a measured SLED deployment.","streamIds":["nvidia"],"roles":{"sales":"Lead with the denominator: Anomity’s Oct 2 Open Agent Safety note says OpenShell/Sentry only cover agents started beside them, while native laptop agents and ad-hoc MCP servers are often the majority. After Sep 28–Oct 1 launch coverage, ask whether the buyer has an agent inventory at all. Useful for CISO and campus endpoint owners. Unsupported: Soft claims that OpenShell fails on enrolled agents, Sentry millisecond quarantine measurements, or Anomity product necessity from NVIDIA materials alone.","engineering":"Fit when scoping agent safety beyond the data-center tray. Integrate OpenShell for enrolled agents and separately inventory Claude Code/Codex/MCP on managed endpoints. Prerequisites: endpoint management reach, acceptable-use policy for local agents. Constraints: Sentry targets Vera/BlueField systems, not laptops; OpenShell has no discovery API. Proof: sample endpoint scan showing agents outside OpenShell before declaring program coverage.","delivery":"Work: stand up inventory baseline, enroll high-risk agents into OpenShell, leave residual native agents under hook/EDR controls. Dependencies: endpoint eng, InfoSec, academic IT, AI platform. Ownership: CISO with endpoint owner. Skills: agent discovery, sandbox enrollment ops. Governance: coverage KPI = sandboxed / discovered. Acceptance: inventory refresh cadence and exception register. Risks: celebrating partner logos while unmanaged endpoints remain uncounted."},"roleDetails":{"sales":{"customerProblem":"Customers may equate Open Agent Safety partner announcements with fleet coverage while unmanaged agents dominate endpoints.","stakeholders":["CISO","Campus/agency endpoint lead","AI platform","Internal audit"],"discoveryQuestions":["What share of agents run inside OpenShell today?","Do you inventory MCP servers on laptops?","Is Sentry even on your hardware roadmap?"],"valueHypothesis":"Framing coverage as sandboxed-over-discovered prevents overselling launch breadth as program completion.","potentialEngagement":"Bounded discovery engagement: inventory sample + OpenShell enrollment pilot for top risk agents.","unsupportedClaims":["Claim that OpenShell discovers fleet agents","Sentry coverage of laptops","Guaranteed reduction in shadow AI from this article alone"]},"engineering":{"fit":"OpenShell for enrolled agents; separate inventory plane for native agents.","architectureIntegration":"Do not route laptop agent traffic through BlueField-4 Sentry assumptions; keep endpoint discovery independent.","prerequisites":["MDM/EDR or dedicated AI-inventory sensor","OpenShell gateway for enrolled workloads"],"constraints":["Sentry is data-center/BlueField scoped","OpenShell has no fleet discovery","Partner count ≠ coverage"],"security":"Treat native agents as residual risk with hook/EDR controls until sandboxed.","proofOfValue":["Endpoint sample listing agents outside OpenShell","Enrollment rate for top-N risk agents","Exception register for unsandboxable tools"]},"delivery":{"work":"Run inventory → risk-rank → enroll → residual-control loop.","dependencies":["Endpoint management","InfoSec","Departmental IT","AI platform"],"ownership":"CISO owns coverage KPI; endpoint team owns discovery refresh.","skillsAdoption":"Train helpdesk on sanctioned sandbox path vs banned native installs.","governanceCheckpoints":["Inventory baseline sign-off","Enrollment milestone review","Residual-risk acceptance"],"acceptanceCriteria":["Documented discovered-agent count","Enrollment of priority agents","Named owner for exceptions"],"risks":["False coverage from partner logos","Inventory stale within weeks","Faculty/researcher pushback on sandboxing"]}},"retrievedAt":"2026-10-03T03:05:00Z","enrichedAt":"2026-10-03T03:05:19Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Inventory and sandbox mandates affect researcher and student developer workflows; plan exceptions and training, not only blocks.","procurementImplications":"Do not accept partner-count or OpenShell download metrics as sole acceptance criteria; require coverage denominators.","operatingModelImplications":"Agent safety becomes a joint CISO–endpoint operating program, not a one-time platform install.","sourceVerification":{"openedUrl":"https://anomity.ai/blog/nvidia-open-agent-safety-platform-openshell-sentry/","referenceExcerpt":"OpenShell governs the agents someone deliberately starts inside it.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}