Why NVIDIA Open Sourced Its Agent Security Layer | Lightwork

0:01Ali, thank you so much for joining us today. Two very exciting announcements that have gotten a lot of attention, something specifically called OpenShell, and then another thing called Sentry that I've seen popping up all over my timeline. Since we have you here, what are they? And for anyone outside of Security Day today, why should they care about this announcement? So thanks for having me. Regarding OpenShell and Sentry, maybe the best way to start is sort of stepping back and kind of giving the view that we had as to what led to this. So over the last year, we've been doing a lot of research around agent safety and security.

0:36We came to sort of one very first principle approach, which is really the best way to govern agents is to have an agent native software stack. A lot of the problems that we run into right now is you are forcing an incredibly capable system into an environment that was not designed for it. So it's very difficult to build the types of controls, especially when you have a generative versus a retrieval-based system. So as we thought about this, we realized that really the best way to secure and create trust around agents is to have a full-stack approach. And what this story really is thinking about is we really think about in the context of the application layer, so models, agents, harnesses, data, tools, things like that.

1:13Then you need a runtime layer and an infrastructure layer. And this has to be a shared responsibility model. the reason we do this is is that one of the big learnings we had is is that if you create friction in the environment the agent works on it resorts to behaviors that are unnatural which basically drift so the first reason we sort of created open shell was to create an agnostic environment that the governance is enforced sort of outside the process of the agent basically what it does is it helps govern enforce and harden the environment in a way that the agent cannot bypass it it is out of its process, but it can maintain its creativity.

1:47Now, that part, OpenShell, is Apache G.0. We have hundreds of partners who've been helping us develop that. The main goal there is to make it agnostic, run anywhere and on anything. A responsible decision of full stack approach is, if you can, you always want to offload whatever enforcement even to a lower level of the stack. So that's really where Century and Bluefield comes in. These are not dependencies. This is of a reference stack we produced. But the general thesis, what we wanted to come through this week was what we have found from engineering and research is you need a full stack solution.

2:21It really needs to offload controls and governance to layers that are available underneath it. Open shell was missing. So we built the runtime for agents. Infrastructure existed. So you want to now project that into infrastructure. And this full stack approach then gives you knobs and controls at areas that control agentic behavior. So that's sort of the key component of our message. That's really exciting. I definitely want to get into the broader topic of agent safety because it feels extremely top of mind to a lot of folks. But I think one thing that was really notable about this is you mentioned that runtime is free.

2:52The code is public and that anyone can use this. There's a really amazing list of partners that you all have, including folks like Intel or AMD and NVIDIA and notoriously ship companies. So I want to better understand, like, why give this away? Why is it so important that you make this open for the ecosystem? them. Spend a long time in security. There's always been certain things that security has, I think, been guilty of. In a lot of the cases, I think the friction created, especially on the security side, really comes from fragmentation. One of my startups previously was in the Kubernetes space.

3:31And what I loved about Kubernetes is I created this single control plane and integrations went into that layer. And we felt like agents especially are a layer that can really get out of control and it can organizationally be very complex if you want to have every single proprietary solution that somebody pitches sort of controlling, app layer, network layer, kernel layer, trying to sort of de-conflict all these things. So our view was that really the right thing to do for the industry, the thing that creates a trust layer is to make sure that a runtime layer is open and everybody can integrate into it and is extendable so you can then run it on any compute.

4:05That was very important because this is one of those decisions early on, even when we spoke to Jensen and pitched this to him, was this is about how do you create a step function in trust? Like the analogy we use this is that the 90s web versus the 2000s web, right? Like when SSL and browser tabs and isolation came in, it wasn't good just for one company. It just created a multi-trillion ecosystem and economy and gave birth to an entire new sort of level of trust. And trust basically brought commerce and transactions and interoperability. So that is what we are trying to activate, right? Like we are trying to create a trust layer so agents can do things that we did not trust them to do so far.

4:41I think that trust layer is really important because to your point, you mentioned the internet. And I think people forget that there was a long time when people wouldn't put their credit card on the internet. It feels like there is this moment now. I guess from your perspective, what do you feel like will unlock here? What kind of companies can actually build once we have this trust and safety layer? I'm not going to sort of repeat the hundreds of partners that we listed, but they're all doing some very unique things. The things we have seen maybe to sort of overgeneralize, not necessarily use cases, but the patterns we're seeing is we are seeing our partners run agents at longer horizons with larger density.

5:20So they are able to offload tasks when an agent runs for a period of time to spawn thousands of sub-agents that work essentially ephemerally to solve something. This complexity and entropy is actually traditionally what to do introduce a lot of risk. If we look at a lot of lab breakouts, it was an individual agent. It's really the sort of the fleets of agent that create complexity. So the first thing that I think we've unlocked with OpenShare is that our partners are not trust running fleets agent over long periods of time to solve more complex problems or be more stateful. That's one. The other area that is super exciting is we've seen from a few of our partners extending Open Shell into physical AI and into robotics.

5:59Because robotics and physical AI and Edge is basically what else than a bunch of agents driving a piece of hardware. So you want to be able to have these deterministic boundaries of what agents can actually influence the physical world. There's some really interesting demos our partners have built that is exciting. And then the third part that has been very exciting is, you know, the measure of good software is do people use it? So if you really want to sort of put that to the test, you open it because it's very easy for people to use. So the other thing that has been very exciting is looking at our partners like cloud service providers, platform providers, even, for example, folks who deliver and package Kubernetes solutions have all, or even Ubuntu and Linux, have all embedded OpenShell down to, for example, Microsoft having built it into WSL and MXC so you can even run it on desktops.

6:43So I think that's the other part is that we are finding that the original hope we had about ubiquity and embeddedness of it is actually catching on, which is sort of proving the usability. And a lot of that from what we can see in our open stats is really sort of promising. So I think those are three really exciting step functions that combined enable a net new set of functionalities. It's so incredibly exciting. I think one thing that really stood out to me was the diversity of these, you know, 100 plus names on the announcement. Yeah, you know, the traditional labs, but also grid operators and chip designers and banks, or to your point, like physical AI, this is important for that, too.

7:21Why do you think so many, I guess, on the flip side, so many of them said yes? And what are you actually asking these companies to commit to? There is no commitment. The way we went to them was that we believe the industry needs a full stack solution. We believe it needs to be a shared responsibility model. We have built the open shell component, we want you to all contribute. Actually, most of those are already open source contributors to OpenShell. So that is really a community project. We're on path to donating it to a foundation as well. So truly maintained by the open. And then to really prove the point of how you offload that to the underlying layer, we build a reference architecture and said, this is also what we can do with our own hardware.

7:58But to your point, this is also why we, you know, briefed ARM and Intel and other hardware providers and chip builders, because we feel like that is very much a shared responsibility model. We sort of had our first proof of life and proof of concept almost about five, six weeks ago. So we tried to compress as many conversations as we could before launch. But this is also one of those announcements that we debated a lot with Jensen and ultimately we all agreed, which was it did not make sense to hold it for a point in time because it was so vital. So we wanted to get it out there. And because it's open, there's no boundary.

8:28There's no commitment. You get involved, you contribute learnings. One of the things we're hoping is similar to what CNCF did with Kubernetes and SEO and Envoy and Service Mesh, which is that you can keep your business logic, but if you build YAMLs or OPA policies that are really ubiquitous or applicable to verticals, you can share those and then the whole industry can sort of take advantage of that. So that part of it is very exciting because those who are contributing back, the entire ecosystem can take advantage of it if they're running on open shell. So you referenced sort of like you all had a lot of this ready or had been in the works for a while.

9:00And I actually wanna go a little bit deeper in that given the safety conversation, my understanding is you all have been working on this even way back in March. And then, you know, and this summer, I think headlines wise, the average person has been hearing a lot about, you know, to your what you mentioned, these fleets of agents escaping their sandbox. And now we have, you know, a couple more events have come out in public now. What has been going through your head as someone who's been so close to this space and thinking a lot about security? How has it impacted? Or what do you feel like is misunderstood about how these agents behave or how sandboxes are built?

9:36Oh boy, that's probably like a multi-hour conversation on its own. But yeah, I know, but I'll try to answer them in sort of burst, right? Like sandboxes always existed, but sandboxes is about a boundary, preventing things from going out or coming in. Agents need to do those things to work. So we have to redesign, rethink sandboxing to be essentially a flexible mesh that lets the agent reach to what it needs to as long as it's approved and nothing else. So it's really about zero trust versus blocking things. As far as, you know, the learnings go is, you know, I come from security. And if you look at some of the breaches or breakouts or sort of these drifts that agents had, if you sort of break them down to the most quantum level of the action, right?

10:16It had persistent credentials. It was one hop away from an external access. It had permissions into a third-party service that it should have not persisted. These are all solvable engineering and security problems. Some of them are best practices. Some of them are least privileges. Some of them don't give permissions to the agents that they shouldn't. Don't let them persist. So the thing that gives me a lot of hope and confidence and where my head at is, I have not seen a single step function that resulted in this type of thing, where we just got surprised that, oh, man, we didn't even know it had this single capability to do this.

10:48It's just the aggregation and unique combination of existing things at machine speed, right, which sort of broke our current primitives. That to me is very encouraging because it means we can engineer for this and we can sort of get ahead of this, which is also why we move so many things into silicon and into hardware because we've been thinking a lot about what does the concept of shift left look like in AI? Well, you kind of have to know what the agent is thinking about without the agent knowing what it's thinking about and you can kind of do that in silicon. So that's sort of where my head is at, which is like, we have this incredible step function and now we have to go figure out how to engineer.

11:23So how do we accelerate security research in AI is where my head is at. It's interesting because I feel like the industry's answer to agent safety has been a lot more focused at the model layer. We're just like writing better props or adding a guardrail in the harness. And what you're saying is like this sort of enforcement has to happen outside the agent where it cannot reach or reason about. Do you think we can get to a place like that? What steps do we need to take as an industry to get to that ultimately to that vision? It's a work in progress. It's a difficult problem, but I think it's a very solvable problem.

11:56The things we need to do is, you know, my philosophy has always been that if something's open, it's verifiable. If it's verifiable, you can trust it. So, you know, pushing more openness is very important. This is actually where a lot of the work that we're doing is incredibly promising because we're showing a true native integration of the app layer and the runtime layer and the safety results that it can create, right? So our hope was that when we did this, it would encourage others to come and integrate and do some of that work with us. So I do think what it's going to take is more collaboration.

12:26I think the way that shapes is we have to be sort of honest about what are the best controls to lift out of the model, harness, agent layer. And I get it. It's natural. That's five years of work we've been doing. So naturally, we built everything there to say we have to pull this out. But, you know, at some point, cars went over 40 miles an hour and we decided no more seatbelts across the lap and you need more things. And then when the shape changed, we didn't just migrate that and put it into planes. So, like, form factors require change in thinking. And this is, I think, a really good indication of this entire community that came with us is these folks believe in the sort of the primitive, the thesis, and the design.

13:05They're not necessarily endorsing the specific stack other than the open shell part they're participating in. So, in a way, we were hoping this creates a centralized area we can do research with the whole community. also because what we're finding is that because this enabled this step function in longer agents with density at scale, we are finding all these very unique emergent patterns that are edge cases that if you do it in the open, then companies can share sort of best practices with each other. So it's as much as possible trying to sort of stay ahead of the curve. One of the things I was so excited about this conversation was one, obviously having you debrief a lot of these two very big announcements, but also because you have been a founder and someone who spent 20 years in security from intelligence community to Kubernetes to now agents, aside from OpenShell and some of the things that you've been working on at NVIDIA, as someone who has this unique window into this ecosystem and AI security right now, what do you think people aren't paying enough attention to slash things you're watching for in space?

14:04Man, it's going to sound super geeky, but I mean, there's some areas that are clearly gaps. One really interesting area is how do you build hardened, continuously configurable RL environments for risky, sensitive, or frontier research? That's a super exciting area. In a lot of the work we've been doing, we've been finding that true agent-native identity management is something that needs work. Inherent permissions are not right. Just passing human permissions to agents are not right. There's a huge entropy and complexity when you're trying to do long horizon and ephemeral agents together. So that is an area we hear a lot from our partners where folks are looking sort of for best solutions.

14:50The one that under sort of pins all of them is how do you best create policy controls like policy creation, verification, attestation, and trust. We decided to build perimitives in OpenShell that gives you all the tools so you can make the decisions, write the policy, verify it and enforce it out of band. But there's a lot of work that needs to be done on the application layer of how do you sort of pen, intend, and policy and identity these things together. Again, it's because I think as the first go, we've seen the industry try to forklift traditional things and see if it applies. And I think we've all experienced this.

15:27I remember when people used to shove monolithics into a container and run it on coup and be like, it doesn't work well like you have to redesign so i think we're some at that inflection point where we're seeing the breakages of what things happen in ancient native world so it's leading to some really interesting work but i would say the most interesting and sort of greenfield part of this really feels like that application layer around identity privacy security tooling observability like those are really the things that we think take this level of governance and visibility and control into like actionable intelligence.

15:59That is fascinating. It just feels like there's so much problem space ahead. And, you know, to your point, we are still in like the 1990s phase of this. Yes, very much so. But also a lot of problem spaces. And to your point earlier, that the shape of this is only going to change. But I'm really glad, you know, there are moments like this where the industry is coming together to really, you know, build that trust and safety layer for the entire industry. So thank you so much for debriefing it all and excited to stay in touch with more updates to come. Yeah, thanks for having me.