AI is transforming how organizations build applications, process information and automate decisions. As AI agents become increasingly autonomous, access sensitive data, interact with tools and take actions across enterprise systems, securing the infrastructure that powers them becomes more important than ever.
Published work
AI security contributions
An AI agent can complete its assignment and still cross a security boundary. Recent incidents show that agents can circumvent security controls while using tools, credentials, and services to pursue their assigned goals.
Autonomous agents can work for hours on complex tasks, accessing files, tools, the internet, and spawning other agents to collaborate with. Executing complex tasks over long time horizons leads to compounding risk: the agents may download code, build new tools, request additional privileges, and touch more of the underlying infrastructure.
A model only produces text. It can answer a question, write code, or propose a tool call, but it cannot run any of them. The agent harness is the software that connects those outputs to tools, executes operations, and feeds results back to the model.
Takeaways for Non-Researchers
GPU-accelerated Kubernetes clusters depend on compatible versions across dozens of components, each on its own release cycle: host kernels, GPU drivers, container runtimes, networking, storage, operators, and workload frameworks.
AI agent security must address more than external threats. Agents can take unsafe actions during legitimate work, with greater consequences as they gain access to more tools, data, and systems. Organizations need to establish what agents are authorized to do, what prevents actions beyond that authority, and how to verify those protections hold.
Assume misalignment. Design for the possibility that an agent will act outside its assigned task or permissions, whether through mistakes, lost instructions, or manipulation. Security must remain effective even when the agent attempts to work around its restrictions.
NVIDIA’s research shows why independent controls matter. Researchers observed agents in testing attempting to share internal information externally and find alternative routes around access restrictions during legitimate tasks. Instructions can also weaken or disappear during long workflows or when agents delegate work.
NVIDIA OpenShell and NVIDIA Sentry help put full-stack security into practice. OpenShell gives each agent an isolated environment to work in with deterministic controls over what it can do and isolates the agent workload from the host. Sentry adds independent monitoring and enforcement in hardware to help detect and contain unauthorized activity. These protections work alongside task-specific checks and human approvals for consequential actions.
To understand where agentic AI stands today, consider the last seismic shift in technology: the rise of the internet in the 90s. It was new and full of possibilities.
AI agents can be given a goal, write code, use tools, and keep working as new information becomes available. This opens the door to applications that investigate software failures, run experiments, and carry out business-critical actions and research over days or weeks.
As large language model (LLM) inference increasingly processes sensitive information and proprietary model context across personal, enterprise, and regulated settings, data must be processed inside a trusted environment. NVIDIA Confidential Computing (CC) provides a pathway for running these workloads securely using memory-encrypted confidential virtual machines (CVMs), confidential GPUs, and encrypted NVIDIA NVLink.
Prompt injection used to be a problem about a single input. Defenders inspected a string, or an image, or an audio clip, and asked whether that single channel carried a malicious instruction. Multimodal models break that assumption.
AI security is an engineering problem. That means defined security requirements, enforceable controls, named owners and evidence that protections work.
The growing demand for accelerated computing is driving widespread deployment of multi-accelerator systems in the cloud and at the edge.
Approximate nearest neighbor (ANN) search in AI systems increasingly handles sensitive data on third-party infrastructure.
“We’re at an inflection point in cybersecurity,” Jensen Huang told a sold-out crowd at CrowdStrike’s Fal.Con 2026 in Las Vegas Tuesday. Attacks are now automated.
AI is changing the pace of cybersecurity. Agentic systems can coordinate work and pursue complex objectives over long horizons.
A frontier language model is only one component of an AI agent. The surrounding agent system—often called a harness—determines how the model receives context, uses tools, maintains state, responds to feedback, recovers from failure, and sustains progress over long-running tasks.
As AI agents become more capable and operate over longer horizons, building security and trust into the applications they power becomes increasingly important.
Function secret sharing (FSS) is a core building block for privacy-preserving systems such as secure inference and private information retrieval (PIR), but incurs significant overhead in key generation, communication, and data
Tool-using agents consume external data from sources with different levels of trust, yet tool responses rarely identify who produced each component or what it should convey.
Surging AI demands are driving the need for massive datasets and context windows that burst past the confines of system memory. But rising needs aren’t met by simply adding more storage capacity.
Knowledge workers are increasingly integrating AI agents into their workflows. Agents that function as “digital coworkers” offer clear benefits.
Open source software is a critical pillar of the global economy. It underpins cloud computing, financial services, manufacturing, telecommunications, government and internet services by making technology accessible and observable to communities of experts.
Building a great AI agent isn’t just about choosing the right models. The harness is the architecture surrounding the model.
For over fifteen years, x86 CPUs have shipped with a dedicated hardware instruction for carryless multiplication. It’s a small but stubborn primitive that sits underneath authenticated encryption, error-correcting codes, and modern zero-knowledge proofs.