Red Hat and Nvidia expand partnership to secure autonomous AI agents

Red Hat also said it is working to integrate Nvidia's OpenShell Reference Architecture into its AI platforms as a native capability. The security approach is intended to address two risks: agents exceeding their authorized boundaries, and attackers compromising agents through prompt injection or supply chain attacks. The companies aim to place security controls outside the agent and, where appropriate, outside the host operating system as well.

“An agent shouldn’t enforce its own boundaries,” John Fanelli, vice president of enterprise software at Nvidia, said in a statement. “Those controls belong outside the agent, in the runtime and the infrastructure beneath it.”

OpenShell provides a sandbox runtime for agents. Beneath that software layer, Nvidia's Sentry security framework runs on Nvidia BlueField data processing units, using DOCA Argus software to monitor workloads from a separate hardware security domain. In a technical blog, Red Hat said Argus inspects selected host memory structures to observe processes, files and network activity without requiring monitoring software on the host. An integrated security system can use its alerts to trigger BlueField policies that isolate an affected workload.

The architecture builds on existing BlueField-3 support in Red Hat OpenShift 4.22. It separates AI workloads running on server CPUs from networking and security services running on BlueField's Arm processors. When configured to restrict host access, that separation helps protect infrastructure controls even if an attacker compromises the host. Red Hat said Sentry can quarantine a compromised agent in milliseconds. Moving monitoring and networking functions onto the data processing unit also reduces demands on host CPUs, leaving more capacity for AI workloads.

The partnership also covers the model infrastructure agents need to reason and act. A joint reference design combines Model-as-a-Service access controls and an AI Gateway with inference technologies including vLLM, llm-d, Nvidia Dynamo and Nvidia NIM microservices. Based on Nvidia's Inference Hub reference design, it supports self-service model discovery, access policies, rate limits and subscription entitlement tracking. Separating access governance from model execution is intended to help enterprises manage quotas, attribute costs and maintain performance across hybrid environments.

The companies also announced joint support for Nvidia Nemotron models, including Nemotron 3.5 Super VL, in the vLLM inference and serving engine and Red Hat AI Factory with Nvidia. Red Hat highlighted quantization and speculative decoding techniques intended to reduce inference latency while preserving accuracy.

For hardware deployment, Red Hat said its Enterprise Linux for Nvidia now supports Vera CPUs and is prepared for the Vera Rubin platform. The companies are targeting operating system and platform compatibility when the new hardware becomes available. An accompanying operating system blog said RHEL for Nvidia 26.03 modifies a limited set of core packages to accommodate new hardware while retaining standard RHEL userspace and security controls, including Security-Enhanced Linux. Users can transition to mainline RHEL without reinstalling once the hardware patches mature and enter the upstream Linux kernel.

Red Hat said the joint use cases, reference designs and agent capabilities are available through partners including Cisco Systems Inc., Dell Technologies Inc. and Lenovo Group Ltd., while work continues on native OpenShell integration.