Red Hat and Nvidia isolate AI agent security to Vera Rubin infrastructure
The partners announce runtime controls and hardware separation to protect autonomous agents from prompt injection and supply chain risks at GTC.
Key points
- Red Hat and Nvidia integrate Sentry security into OpenShift for Vera Rubin hardware.
- Agent boundaries are enforced outside the runtime via BlueField data processing units.
- OpenShell sandboxing separates AI workloads from host operating system controls.
Red Hat Inc. and Nvidia Corp. announced expanded collaboration to secure autonomous artificial intelligence agents through hardware-level isolation and runtime controls. The partnership focuses on deploying workloads onto Nvidia’s upcoming Vera Rubin data center infrastructure. Announced during the GTC event in Berlin, the initiative aims to govern access to AI models while preventing agents from exceeding authorised boundaries.
Root cause
The design addresses vulnerabilities where autonomous agents might act beyond their intended scope or suffer compromise through prompt injection and supply chain attacks. According to the announcement, placing enforcement mechanisms inside the agent itself is insufficient. Nvidia’s John Fanelli stated that controls must reside in the runtime and underlying infrastructure rather than within the agent code.
Attack path
Threat actors could exploit agents via prompt injection or by compromising the supply chain. The new architecture mitigates this by separating AI workloads running on server central processing units from networking and security services on BlueField Arm processors. This separation ensures that even if a host is compromised, infrastructure controls remain protected from attacker influence.
Affected versions
The architecture builds upon existing BlueField-3 support within Red Hat OpenShift 4.22. It integrates Nvidia’s OpenShell Reference Architecture as a native capability into Red Hat AI Factory. This setup allows for hybrid cloud deployment while maintaining distinct security domains for monitoring and workload execution across the infrastructure.
Mitigation
- Deploy Red Hat AI Factory with Nvidia to implement agent runtime controls.
- Use Nvidia’s Sentry framework on BlueField units to monitor host memory.
- Configure OpenShell to sandbox agents and isolate compromised workloads.
- Leverage DOCA Argus to trigger policies that quarantine affected processes.
What it means for organisations
Teams managing AI deployments should review how agent boundaries are currently enforced. Verify whether security controls reside within the application code or the underlying infrastructure. Ensure that supply chain risks for AI models are addressed through external monitoring. Operations leaders must confirm that hardware separation is available in their chosen cloud or on-premise environments to prevent lateral movement during a breach.
Background: Supply chain attacks
Supply chain attacks in cyber security exploit the trust you place in third-party software components. Attackers inject malicious code into legitimate updates or build pipelines. You receive the payload as if it were benign. Defending requires verifying code origins, isolating build environments and treating all external inputs as hostile.
Read the full guide: Supply chain attacks in cyber security: how they work and how to stop them
What to do and how to stay safe: Red Hat
- Audit current AI agent configurations to identify where permission boundaries are enforced.
- Review vendor documentation for hardware-based security features in existing data centres.
- Monitor for updates regarding OpenShell integration in your primary cloud platforms.
- Prepare incident response plans that account for autonomous agent behaviour anomalies.
Step-by-step guide: Prevent Prompt Injection Attacks: Practical Defences for AI Systems
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does Sentry protect against compromised agents?
Sentry runs on BlueField units and uses DOCA Argus to inspect host memory, allowing it to quarantine affected workloads in milliseconds without requiring software on the host.
Which Red Hat product version supports this architecture?
The architecture builds on BlueField-3 support available in Red Hat OpenShift 4.22, separating CPU workloads from Arm-based security services.
What specific attack vectors does this partnership address?
The collaboration specifically targets risks related to agents exceeding authorised boundaries, as well as prompt injection and supply chain attacks targeting autonomous AI systems.
