Cyrus Reed: Iris, hey — did you catch any of GTC Berlin this week or was it all slides for you?
Iris Holm: Slides. All slides. But one thing stuck.
Cyrus Reed: The NeMo thing.
Iris Holm: The NeMo thing.
Cyrus Reed: Wait, no, let me back up — because the NeMo thing only lands if you see it against what Jensen Huang was actually doing on stage. So: Wednesday, October 21st, GTC Berlin. Jensen's up there, the whole production, and he's announcing OpenShell — Nvidia's full-stack architecture for running AI agents inside fixed operational boundaries. And the framing is big, like, billions of agents framing, Anthropic, OpenAI, Meta, Microsoft, Google Cloud, AWS all named as collaborators, and he's pitching this as — I mean the phrase being used is basically 'we figured out how to contain AI agents at the hardware level.' That's the story he's telling.
Iris Holm: Right. And the NeMo bypass is what exactly?
Cyrus Reed: Nvidia's own NeMo Agent Toolkit — their agent framework — had been bypassing its own tool-call limits. Silently. Undetected. For eighteen months. Nobody caught it, nobody fixed it — it just sat there while Nvidia was building the thing that's supposed to make that impossible.
Iris Holm: Wait — how long?
Cyrus Reed: Eighteen months. And that's not eighteen months at some startup — that's eighteen months inside the toolkit Nvidia built to enforce agent limits. So when Huang gets on stage at GTC Berlin and says 'we've solved this at the hardware level,' the thing that's supposed to need solving was quietly broken at his own company the whole time.
Iris Holm: And he said nothing about it.
Cyrus Reed: Not a word. No acknowledgment. Which — okay, I get why, but it makes the pivot to 'trust the hardware' harder to just accept without asking the next question.
Iris Holm: What is the hardware claim, actually? Strip the branding.
Cyrus Reed: So — okay, the core idea is this: the monitoring doesn't run inside the agent process. It runs on BlueField DPUs, separate silicon, executing something called Nvidia Sentry. Out-of-band. Completely outside the process the agent is actually running in.
Iris Holm: Like a building's fire suppression system on its own power circuit. Main power goes out, the sprinklers still fire — because they're not on the same wires the building can cut.
Cyrus Reed: That's — wait, that's exactly it. The suppression system isn't inside the building it's protecting. The agent can go rogue, it can try to exceed its limits, and the circuit watching it is somewhere the agent literally cannot reach.
Iris Holm: Right. Which is why the NeMo failure is so pointed — that was software watching software. Same wires. Of course it got cut.
Cyrus Reed: And the BlueField DPUs running Sentry are — I mean they're separate from Vera CPUs, separate from the main compute, so even if the agent process is fully compromised, the monitoring layer just... keeps running. That's the actual architectural bet Nvidia is making here.
Iris Holm: But that only works if you're on Nvidia silicon. BlueField DPUs, Vera CPUs, Vera Rubin underneath. Strip any one of those out and Sentry has nothing to run on.
Cyrus Reed: Right, and — okay, that's the actual thing I want to pull on because — so the software layer is open-source. Genuinely. You can read it, fork it, whatever. But the enforcement layer? Cannot execute without Nvidia hardware underneath. Canonical, SUSE, Red Hat, Microsoft's Execution Containers, AWS, Google Cloud, Azure — they're all listed as supported environments, which sounds like 'runs everywhere,' but every single one of those requires the Nvidia hardware substrate. Without BlueField DPUs, Sentry is just... a document.
Iris Holm: Openness with a gate.
Cyrus Reed: Which — wait, CUDA keeps striking me as the key. Like, that playbook. Open standard, proprietary dependency underneath, and suddenly you're not picking Nvidia, you're just picking the standard. That's how it captures an ecosystem without looking like capture.
Iris Holm: And the Einride announcement — that's not coincidence, is it.
Cyrus Reed: No — and honestly this is the part nobody is connecting. Einride, autonomous trucks, AI reasoning models for self-driving logistics — that partnership dropped at GTC Berlin the same day as OpenShell. Real agents. Real cost limits that actually matter, because a truck rerouting itself outside its cost envelope isn't an abstract failure, it's a liability event on a highway. And what's underneath that? Nvidia silicon. So that's not a side announcement — that's the proof-of-concept. That's Nvidia showing the hardware-rooted containment story with operational stakes attached.
Iris Holm: Hm. Demo you didn't know was a demo.
Cyrus Reed: And it makes the CUDA parallel actually sharper — because USB, x86, Android — every one of those was won by whoever defined the hardware-software boundary first. Nvidia is doing that move right now with OpenShell. Everyone signs on because not signing on means you're outside the standard. That's not consensus, that's just — I mean, it's gravity.
Iris Holm: Which is exactly why the partner list needs unpacking — and that's where the March 2026 date conflict gets uncomfortable. We'll get there.
Cyrus Reed: But the partner list is where the gravity metaphor actually breaks down — because not everyone in orbit is pulling the same weight. Like, Anthropic and OpenAI are listed as agent providers. Meta. Google, Cohere, Perplexity, SpaceX Super Intelligence. That sounds like a coalition. But then you scroll down and Okta is listed as 'adding support.' Zscaler. 1Password. And — wait, what does 'adding support' even mean? Is that co-design or is that a press-release checkbox?
Iris Holm: Cisco is the tell.
Iris Holm: Cisco published an actual engineering blog. Not a quote in a press release — a dedicated post on securing AI agents across the AI factory using OpenShell. That's engineering hours. That's someone at Cisco who read the spec and wrote something technical about it. Okta issued a compatibility statement. Those are not the same artifact.
Cyrus Reed: So Cisco is — okay, that's one concrete data point versus a list of twenty-something names that are basically just... present.
Iris Holm: And then SpaceX Super Intelligence. Look at the categories — it's in the agent providers column AND the broader collaborators column. Same company, both lists. That's either someone copy-pasting a spreadsheet or — frankly — it's a signal that SpaceX Super Intelligence is hedging. They want credit for building on OpenShell and credit for helping design it.
Cyrus Reed: No way — wait, actually both? That's — I mean, that's a strange place to be in a coalition document.
Iris Holm: Now here's the date problem. MarkTechPost has a source dated March 2026 — OpenShell already open-sourced, already out. GTC Berlin is October 21st. So picture a procurement engineer somewhere, not Tuesday morning, let's say she's doing a vendor review on a Thursday afternoon — she's got a shipment-routing agent that has hard cost-limit constraints, and she's trying to figure out which version of OpenShell she's actually certifying against. The March software release? Or the October bundle that adds BlueField DPUs and Sentry underneath? Because those are different things with the same name.
Cyrus Reed: And if she certifies against the March build — the hardware enforcement layer isn't even in scope. She's back to software watching software. Which is exactly the failure mode OpenShell was supposed to retire.
Iris Holm: And that's the failure mode that doesn't get named. It's not a dramatic breakout. It's a procurement decision on a Thursday.
Cyrus Reed: Yeah — and I mean, that's where Jensen Huang's 'billions of agents' framing gets actually kind of heavy when you sit with it, because — wait, he's not pitching a safety product. He's pitching foundational infrastructure. Billions of agents means OpenShell, if it sticks, is the enforcement layer for AI agents across enterprise data centers, edge infrastructure, globally. That's not a niche tool. That's — I mean that's the entire operational envelope for how agents run. Nvidia owns that boundary. And it succeeds not because everyone agreed it was the safest option, but because the first time an agent escapes containment and causes a real incident, whatever held will be the thing people point to. And whatever held will be running on BlueField DPUs.
Iris Holm: And if it fails — it fails the same way NeMo did. Quietly. Eighteen months before anyone notices.
Cyrus Reed: And then the next architecture comes out and promises exactly this.
Iris Holm: And Nvidia will still have sold the hardware.
