NVIDIA OpenShell Blueprint and ServiceNow Arc

An AI agent that tries to step outside its permitted boundary should be quarantined and stopped “in milliseconds”, NVIDIA says, and not by software alone but by a dedicated data processing unit. That is the pitch behind the NVIDIA OpenShell Reference Architecture, announced at GTC Berlin on Wednesday and available now.

The first commercial product built around it arrived the same day. ServiceNow said Arc, which it calls “the personal long-running AI agent built for the enterprise”, is now generally available, with its actions enforced by NVIDIA OpenShell.

Think on Rubin, act on Vera, governed on BlueField

OpenShell itself is NVIDIA’s open source secure runtime for agents, the boundary an agent works inside. The reference architecture wraps that software in a full hardware stack. Vera Rubin systems run the models, including closed models and open ones built with NVIDIA’s Nemotron. Vera CPUs run the agent harnesses, the code that lets an agent use tools. BlueField-4 data processing units run NVIDIA Sentry, a security framework that watches agent behaviour “out-of-band”, separately from the system it is monitoring, and enforces policy in silicon.

“With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField,” said Jensen Huang, NVIDIA’s chief executive. He added that “as enterprises prepare to deploy billions of AI agents, safety and control must be built into the computing architecture.”

NVIDIA also attaches performance claims to the stack: 30 times higher throughput per megawatt for agentic workloads on Vera Rubin NVL72 systems, twice the performance of x86 processors for Vera CPUs, and up to 20% more agent capacity from running Sentry on BlueField-4. These are NVIDIA’s figures and the release gives no test details. The architecture also extends to smaller machines at the edge, including RTX Spark laptops and DGX Spark and DGX Station systems, and runs on Canonical, SUSE and Red Hat Linux, on Windows using Microsoft Execution Containers, and on AWS, Google Cloud and Microsoft Azure.

A long list of partners, few deployments

NVIDIA’s partner list is long: Anthropic, AWS, Cisco, CrowdStrike, Google Cloud, IBM, Meta, Microsoft, OpenAI, Palo Alto Networks, SAP, Siemens, SpaceX Super Intelligence and many more. NVIDIA describes them as “among those working with” the architecture. That is not the same as running it in production, and the wording varies by group. Security firms including 1Password, Okta and Zscaler are “integrating support”; Europe’s BBVA and Santander are working with NVIDIA “to explore” it; cloud providers such as CoreWeave, Nebius and Nscale are working on “OpenShell-ready infrastructure”. SAP is more specific, saying it is integrating the architecture with its Joule Studio runtime.

ServiceNow is the clearest case of a shipping product. Arc runs across ServiceNow workflows, email, Teams and other office tools, plans and carries out tasks that can last “minutes or days”, and can build its own integrations when none exists. It can run on its own computer inside an OpenShell runtime or on an employee’s desktop, using local models on RTX Spark for routine work and frontier models for harder tasks, the company says. IT departments set policies in ServiceNow’s Super Intelligence Control Tower, which OpenShell then enforces.

The hardware kill switch is not here yet

The more ambitious piece is still to come. ServiceNow’s AI Passport, announced last week, is a signed record of what each agent is allowed to do. ServiceNow now says OpenShell and Sentry on BlueField will read it, so that revoking an agent’s passport stops it in both software and hardware, within “approximately one second”. Only the revoked agent’s traffic would stop, with other workloads on the same server carrying on. But ServiceNow says that enforcement “is expected to be available in a future release”. When TSN covered the launch, AI Passport was due in the fourth quarter.

ServiceNow describes the combination as “industry-first” in its headline, and Jon Sigler, who runs its AI Platform, calls Arc “the first personal AI agent built for everyday work and governable by IT”. Those are the company’s own claims.

Arc is included at no extra cost in ServiceNow EmployeeWorks on its Foundation, Advanced and Prime plans. It works on Mac now, with Windows support expected within weeks. For NVIDIA, which last week pledged $250m of computing power for UK research on safer agents, the test is whether the companies now “working with” OpenShell turn into names running it.