Red Hat and NVIDIA Harden AI Agent Security on OpenShift

Red Hat and NVIDIA have announced general availability support for NVIDIA BlueField-3 Data Processing Units (DPUs) within Red Hat OpenShift 4.22, establishing an out-of-band security and governance architecture for enterprise AI agents. Built around the DOCA Platform Framework (DPF), the deployment implements a dual-cluster topology that physically isolates untrusted agent runtimes on host CPUs while anchoring network inspection and access control inside the DPU’s independent Arm processor domain. Using NVIDIA DOCA Argus for memory introspection and NVIDIA Sentry for hardware-level policy enforcement, the architecture mitigates prompt injection takeovers and unauthorized tool execution without consuming host compute capacity.

Hardware-Isolated Runtime Security for Autonomous AI

Enterprise adoption of autonomous AI agents introduces an execution risk profile distinct from standard inference pipelines. Because agents are designed to execute tool calls, alter databases, and trigger operational workflows autonomously, system behavior diverges when prompts contain ambiguous constraints or external instructions. Traditional software guardrails located inside the model context or within the host operating system remain vulnerable to prompt injection and supply-chain compromises. Once an agent process is hijacked, any security monitoring agent residing on the same host operating system can be subverted or blinded by the compromised workload.

To address this structural exposure, Red Hat and NVIDIA have moved governance to dedicated silicon via the NVIDIA OpenShell Reference Architecture. In OpenShift 4.22, the DOCA Platform Framework divides a server into two distinct operational clusters: a tenant cluster running containerized agent workloads on host x86 or ARM CPU cores, and an infrastructure cluster running on the BlueField DPU’s embedded Arm cores. Operating in Zero Trust mode, the BlueField hardware restricts host access to its management bus and telemetry interfaces, ensuring that administrative control persists even if the primary host kernel is completely compromised. This approach complements broader venture and enterprise investments in agent containment frameworks, such as initiatives tracked by Pluto Security, by substituting software-level wrappers with verifiable physical boundaries.

Out-of-Band Memory Introspection and Instant Network Quarantine

Real-time threat detection within this architecture is managed by DOCA Argus, a security monitoring service running natively inside the BlueField DPU environment. Rather than relying on host-based kernel modules or sidecar containers, DOCA Argus conducts out-of-band machine introspection by reading designated host-memory structures across the PCI Express interface. This allows platform security teams to continuously monitor process execution, identify open socket connections, and compute runtime hashes of active binaries without alerting a malicious actor or consuming host operating system memory.

Inline traffic governance is handled simultaneously by NVIDIA Sentry, a unified security software framework built on DOCA that sits directly on the network path between agent runtimes and backing foundation models. Sentry pairs an accelerated Layer-4 firewall powered by DOCA Flow with DOCA Tower, an Envoy-based transparent proxy that offloads TLS termination and evaluates Open Policy Agent (OPA) rules in hardware. When DOCA Argus identifies unauthorized command patterns or unexpected network destinations, the DPF operator commands the BlueField DPU to sever the workload’s Virtual Function (VF) interface. The rogue agent is partitioned in milliseconds at the hardware bus level, preventing lateral movement across the cluster.

Eliminating the Infrastructure Tax on Enterprise AI Compute

Beyond isolation, migrating security and packet processing to BlueField-3 DPUs addresses substantial operational bottlenecks in modern data centers. In standard dense server deployments, networking functions, cryptographic handshakes, and packet filtering generate an infrastructure tax that routinely drains between 20% and 30% of host CPU cycles. Offloading this compute overhead to dedicated DPU silicon returns those processor cores to continuous reasoning loops, tool routing, and orchestration pipelines, while enabling deterministic network throughput up to 400 Gb/s.

This operational integration serves as a foundational component of the Red Hat AI Factory with NVIDIA. The joint offering incorporates the open-source OpenShell sandbox runtime and establishes Day 0 platform enablement on Red Hat Enterprise Linux for upcoming NVIDIA Vera CPUs. By offloading networking layers and telemetry gathering to hardware subsystems, platform engineering teams can deploy long-running agent swarms at scale without degrading host model inference or exposing corporate networks to unmonitored code execution.

What happens next

General availability of BlueField-3 DPU support in Red Hat OpenShift 4.22 allows enterprise infrastructure teams to begin provisioning dual-cluster node topologies in production environments immediately. Organizations deploying agentic workflows must evaluate server chassis compatibility, verify PCIe slot power allocations for BlueField cards, and configure DOCA Platform Framework operator profiles across their clusters. Platform teams should also map existing Open Policy Agent rules into DOCA Tower to establish baseline egress policies for agent execution sandboxes.

Looking ahead, NVIDIA and Red Hat plan to expand hardware-governed agent security into next-generation server architectures previewed at GTC Berlin. The roadmap incorporates upcoming NVIDIA Vera Rubin NVL72 rack-scale systems—engineered for dense multi-agent inference—alongside future NVIDIA BlueField-4 DPUs designed to extend in-silicon Sentry inspection to multi-node distributed agent fabrics.