From the NVIDIA edition of October 2, 2026
Anomity: Open Agent Safety puts controls outside the agent—now count agents outside it
Anomity Research · AI agent security / independent analysis · Global (U.S.-facing vendor security blog)
- Publisher
- Anomity
- Original publication
- 2026-10-02T00:00:00Z
- Source retrieved
- 2026-10-03
- Event date
- 2026-10-02
What happened
Oct 2, 2026 Anomity analysis of NVIDIA’s Sep 28 Open Agent Safety Platform restates OpenShell (sandbox + supervisor policy, credentials outside workload, OCSF) and optional Sentry on BlueField-4 for Vera/BlueField data-center systems, citing 100+ organizations working with the stack (Anthropic, Salesforce, SAP, Red Hat, SUSE, Canonical). The core new operating claim: OpenShell and Sentry do not see coding agents installed natively on laptops, desktop assistants adopted ad hoc, or MCP servers started from READMEs—and on most fleets those are the majority. Anomity cites its prior containment-gap survey framing (46 of 57 enterprises that solved agent identity had never built isolation) as why a free sandbox alone does not close the program.
Why it matters
Warns SLED buyers that Open Agent Safety adoption metrics that count only sandboxed agents will miss shadow agents on unmanaged endpoints—critical for higher-ed and agency laptop-heavy fleets.
Evidence and measured results
Opened Anomity Insights post dated Oct 2, 2026. TL;DR and body explicitly separate OpenShell/Sentry coverage from native endpoint agents and reference containment-gap survey counts.
Limitations and uncertainty
Anomity sells complementary endpoint inventory/governance; survey figures are Anomity’s prior research, not a new independent third-party study in this post; not a measured SLED deployment.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-03; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Customers may equate Open Agent Safety partner announcements with fleet coverage while unmanaged agents dominate endpoints.
- Stakeholders
- CISO
- Campus/agency endpoint lead
- AI platform
- Internal audit
- Discovery questions
- What share of agents run inside OpenShell today?
- Do you inventory MCP servers on laptops?
- Is Sentry even on your hardware roadmap?
- Value hypothesis
- Framing coverage as sandboxed-over-discovered prevents overselling launch breadth as program completion.
- Potential engagement
- Bounded discovery engagement: inventory sample + OpenShell enrollment pilot for top risk agents.
- Unsupported claims
- Claim that OpenShell discovers fleet agents
- Sentry coverage of laptops
- Guaranteed reduction in shadow AI from this article alone
Pre-sales engineering
Role takeaway
- Fit
- OpenShell for enrolled agents; separate inventory plane for native agents.
- Architecture and integration
- Do not route laptop agent traffic through BlueField-4 Sentry assumptions; keep endpoint discovery independent.
- Prerequisites
- MDM/EDR or dedicated AI-inventory sensor
- OpenShell gateway for enrolled workloads
- Constraints
- Sentry is data-center/BlueField scoped
- OpenShell has no fleet discovery
- Partner count ≠ coverage
- Security
- Treat native agents as residual risk with hook/EDR controls until sandboxed.
- Proof of value
- Endpoint sample listing agents outside OpenShell
- Enrollment rate for top-N risk agents
- Exception register for unsandboxable tools
Delivery
Role takeaway
- Work
- Run inventory → risk-rank → enroll → residual-control loop.
- Dependencies
- Endpoint management
- InfoSec
- Departmental IT
- AI platform
- Ownership
- CISO owns coverage KPI; endpoint team owns discovery refresh.
- Skills and adoption
- Train helpdesk on sanctioned sandbox path vs banned native installs.
- Governance checkpoints
- Inventory baseline sign-off
- Enrollment milestone review
- Residual-risk acceptance
- Acceptance criteria
- Documented discovered-agent count
- Enrollment of priority agents
- Named owner for exceptions
- Risks
- False coverage from partner logos
- Inventory stale within weeks
- Faculty/researcher pushback on sandboxing
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Pair OpenShell enrollment with endpoint inventory of agents/MCP/CLIs; do not treat DPU Sentry attach as a substitute for endpoint discovery.
Governance
Who approves, reviews and stays accountable for outcomes?
Define success as covered agents over discovered agents; require inventory tooling or MDM/EDR hooks in the same program as OpenShell.
Security and privacy
What data, permissions and controls need testing?
Residual risk concentrates on unmanaged developer machines and MCP servers outside the sandbox; Sentry’s data-center scope does not remediate that.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Inventory and sandbox mandates affect researcher and student developer workflows; plan exceptions and training, not only blocks.
Procurement
What should contracts, pricing and exit terms secure?
Do not accept partner-count or OpenShell download metrics as sole acceptance criteria; require coverage denominators.
Operating model
Which teams own the service once it runs?
Agent safety becomes a joint CISO–endpoint operating program, not a one-time platform install.
Publication history
- 2026-10-02NVIDIA · Issue 286 resources
Stable resource ID: anomity-oas-containment-gap-20261002