NVIDIA Says AI Agent Security Is an Engineering Problem: Controls at Every Layer, from the Model to Where Actions Run

What happened: NVIDIA proposes an engineering framework for AI agent security

On September 21, 2026, NVIDIA's official blog published "AI Security Is an Engineering Problem," written by Saša Zdjelar. The post opens by stating that "AI security is an engineering problem" and makes this concrete with four elements: clear security requirements, enforceable controls, named owners, and evidence that the protections are effective. NVIDIA argues that as AI capabilities grow, the industry must speed up security engineering, broaden access to defensive tools, and share what works more quickly.

According to NVIDIA, the internet and the cloud changed how software runs, but the core security responsibilities did not change: establishing identity, controlling access, limiting exposure, and verifying that protections work. What is new about AI agents is that they can reason, use tools, and adjust their actions based on the data they encounter. The post also acknowledges that organizations want the productivity gains of AI, while practices for governing and protecting such systems are still developing.

Read the full description

Sources are collected, independently checked, then reviewed by Jev.

NVIDIA's three-layer agent stack and key principles

The post divides agent systems into three layers, which together it calls the agent stack: the model provides capability; the harness organizes context, tools and workflows; and the runtime provides the infrastructure where actions actually execute. NVIDIA says every layer carries security responsibilities, and controls are needed across layers as data, instructions and actions flow through the system.

The post illustrates this with a scenario: while updating a customer record, an agent encounters malicious instructions in an attached document and then attempts to export customer data to an unauthorized destination. In NVIDIA's view, network policy should block the transfer, and protected logs should record the attempted tool call, the authorization decision and the outcome so the security team can trace what happened. Permission to update records should also not automatically include permission to export data; the agent may request additional access but cannot approve it itself.

• Boundaries independent of the agent's judgment: the runtime should enforce its own limits on files, network destinations and processes, so they hold even when the agent makes a wrong decision.
• Identity and least privilege (giving only the permissions a task needs): every agent should have a traceable identity, with credentials (the keys and logins it uses) limited to its assigned task.
• Human checkpoints: significant actions and permission changes still require human approval.
• Supply chain checks: verify the origin and integrity of the tools, skills and dependencies an agent uses.
• Retain evidence: keep protected records of tool calls, authorization decisions and outcomes, and have procedures ready to revoke access and contain incidents.

Tools mentioned in the post

In the post, NVIDIA introduces its own open-source OpenShell, describing it as a secure runtime that enforces policy outside the agent's reach and provides sandboxed execution, meaning the agent's actions run in an isolated, fenced-off environment. The post also lists tools from several vendors as examples. The table below is compiled from NVIDIA's descriptions; neither the features nor their effectiveness have been verified by this site or any third party, and nothing here is a purchasing recommendation.

Testing and open tools: NVIDIA's position

NVIDIA argues that before deployment there must be evidence that controls can stop an agent from obtaining credentials beyond its task or sending sensitive data to unauthorized destinations. Testing should also cover attempts to change permissions or interfere with monitoring, and should be repeated after significant changes to models, tools or workflows. The post says a named owner must decide on release based on test results, failed tests must lead to fixes, and every finding can be turned into a repeatable test.

On tool choice, the post says closed models offer managed capabilities and services, while open models let defenders inspect components, adapt strategies and run on infrastructure they control. NVIDIA notes that when an incident occurs, this control helps teams reproduce the problem on their own systems and test fixes while keeping sensitive evidence in-house.

What it means for everyday readers

More and more services are letting AI agents look up information, edit records and call other systems on people's behalf. The points NVIDIA raises apply to ordinary users too: what an agent "can do" should be determined by system boundaries, not just its own judgment; key actions should be confirmed by a person; and when something goes wrong, it should be traceable. As you start using AI agents at work or in your personal life, look at whether the service lets you set permissions, whether it asks for your confirmation before important operations, and whether it keeps an operation log you can review.

Browse the latest news in this topic

• Tech news