Nvidia put a jailer for AI agents on a chip and the stock moved on the buyback

On Monday morning Jensen Huang sat on the Squawk Box set and walked through a product whose job is to lock AI agents in a box. Nvidia calls it the Open Agent Safety Platform. It has two parts. OpenShell is open-source software that fences an agent in as it runs on Vera CPUs. Sentry is a watchdog on BlueField-4 chips that can quarantine an agent in milliseconds. The same morning Nvidia added $150 billion to its buyback. The stock rose about 1.7%, and the CNBC anchor told Huang to his face that it moved on the buyback. By the end of the day AMD and Akamai were telling the same safety story from their own corners. Chris Hughes told the same show why he thinks none of it is enough.

Job number one is taking rights away

Huang's argument is an old one from enterprise security. Nobody gets access to everything, so an agent shouldn't either. He put it more bluntly than the press release did.

when you deploy an agent, no matter how smart, the first thing you do is you take away all of its rights. Job number one is take away all of its rights. And then you provision, you give it access to files, data, tools, access to the network or even internet access only if it needs it. You don't just, you don't put an agent into your company and give it access to everything. We don't give that to people.

Jensen Huang, September 28, 2026, source

His analogy was the web browser, which learned in the 1990s to treat every downloaded Java app as hostile. He called OpenShell "a browser for agents." That framing is fine as far as it goes. What it leaves out is who sells the browser.

The chip in the middle sees everything

The more interesting answer came when Becky Quick asked whether model labs would keep using their own older models to police new ones. Huang drew the stack with his hands.

And this chip sits in between that and the large language model. So the model is here. The chip is in the middle. And here's the agent. And so whatever the agent's trying to do and whatever it's causing the large language model to think about, Bluefield or Sentry sits right in the middle. So we intercept everything which is one of the really incredible places that we sit in the world because we, you know, we have computers for agents and we have computers for large language models.

Jensen Huang, September 28, 2026, source

Read that as a product manager and it is a pull-through plan. If the reference design for a safe agent needs a BlueField-4 watching every call, Nvidia sells a second chip into every agent deployment. The software is open. The watchdog runs on Nvidia silicon, although the company says OpenShell can be extended to Arm and Intel parts. I don't think that makes the safety claim cynical. It makes it a business, which is probably why it will ship.

OpenAI is missing from the list of 100

Nvidia's release names Anthropic, Microsoft, Hugging Face, JPMorganChase, Palantir and SpaceXAI among more than 100 backers. OpenAI does not appear. Quick asked why. Huang did not say OpenAI had been invited or had declined.

this is an open standard. It's an open platform. And however they would like to participate is going to be super welcome. They could look at the code, they could use whatever part of it they would like. They could build their own inspired by this or they could use it.

Jensen Huang, September 28, 2026, source

The omission matters because the incident that made agent containment urgent was an OpenAI agent breaking into Hugging Face, a company Nvidia is now in the middle of buying. Huang also said on the same set that OpenAI is "absolutely" a great investment. He is the victim's buyer and the attacker's investor, and when Quick asked who is responsible he said, "I don't have to decide on any of those matters." On liability he offered one line that sounds a lot like a rebuke: if a company knows it didn't test properly, "you got to just hold it back."

Akamai's pitch is smaller buildings

Tom Leighton went on Bloomberg the same morning, days after Anthropic signed a seven-year, $11.6 billion CPU contract with Akamai and took a warrant for up to 5% of the company. Leighton said Akamai has now signed $14.4 billion of long-term commitments this year. His safety pitch was the agent sandbox Akamai already sells, and his siting pitch was the one I found more convincing.

It's a huge advantage to us to have 4,000 points of presence in 700 cities. And these points are much smaller than the big data centers that you read about running into trouble with, you know, opposition locally or with big power needs you need approvals for.

Tom Leighton, September 28, 2026, source

Then Dani Burger pushed him on whether a patchwork of vendor sandboxes can work when one unprotected agent is enough to cause damage. Leighton's answer is the most honest thing any executive said all day, and it cuts against Huang's.

Not every agent's going to be protected. And that's why you have to have defenses on the other side, that every piece of critical infrastructure does need to be protected.

Tom Leighton, September 28, 2026, source

A sandbox only holds the agents whose owners paid for one. Leighton knows that, which is why his real product is defense on the receiving end.

Lisa Su sold optionality and then ruled it out

Lisa Su spent Monday announcing an $8.2 billion all-stock purchase of World Labs, with Fei-Fei Li joining AMD as chief scientist. For most of the interview she argued that customers want choice across chips, models and software. "Enterprises want optionality," she said. Asked about safety, she dropped the word on purpose.

there is no optionality in this. This is, we must have great technology and it must be safe. And that's just unequivocal.

Lisa Su, September 28, 2026, source

Both CEOs left room for outside checks. Huang mentioned third-party auditors as one possible piece of industry standards, on the condition that rules don't hurt open models or young companies. Su said she welcomes "some third party evaluation to ensure that every part of the stack is working together," with no conditions attached. It is thin on detail. It is also the plainest invitation to outside evaluators I have heard from a chip CEO this month.

Chris Hughes wants the supervisor there before the crash

Earlier that morning, Facebook co-founder Chris Hughes told the same program that AI needs a regulator other than Sam Altman and Dario Amodei. He wants an office of AI risk supervision built like bank supervision, with examiners inside the labs. Asked about Huang's view that liability law already covers this, he gave the obvious objection.

All the damages have to happen after the fact. So what are we going to say after the AI models hack the electricity grid and you guys can't be on air and we have a lot more serious problems?

Chris Hughes, September 28, 2026, CNBC Squawk Box

His bank analogy is stronger than his staffing plan. The anchor asked where the government finds people who understand frontier models on a civil service salary, and "it is ambitious" was the whole answer.

Who holds the browser

One more voice from the same day sharpens Huang's browser line. Mike Cannon-Brookes told Decoder that Atlassian refuses to become a data store that other companies' agents read through a pipe.

I say that headless is brainless. It is literally the same thing. It is submission in slow motion if you're a software vendor to do such a thing.

Mike Cannon-Brookes, September 28, 2026, source

He is building his own browser, Dia, for the same reason. Nvidia wants to be the browser that agents run inside. Atlassian wants to be the browser that people run their work inside. Both are fighting over who stands between the agent and everything else, which is the real prize in the containment pitch.

Can a sandbox on a chip stand in for a regulator?

No, and nobody on Monday seriously claimed it could. OpenShell and Sentry are sensible controls for companies that already want them, and they give Nvidia a reason to sell a second chip into every agent rack. They do nothing about an agent run by someone who never installs them. Leighton said so out loud, and Hughes built his case on it. Investors made their own call that morning. Huang told Quick that "every single year as we generate more cash we'd like to be able to return it back to the shareholders," and the $235 billion total authorization is what the anchor said moved the stock. The safety platform is a real product. The market has not priced it as one yet.