Red Hat and NVIDIA add agent-security designs to their AI Factory collaboration

Red Hat and NVIDIA are putting security boundaries and model-access rules into the same enterprise AI blueprint. At GTC Berlin on October 21, 2026, Red Hat announced an expanded AI Factory collaboration covering agent security, governed model execution and hardware compatibility—aiming to give companies more control over agents that reason and act.

Keeping the controls outside the agent

The security design targets two problems: agents acting beyond their permissions and attackers compromising them through prompt injection or supply-chain attacks. Red Hat and NVIDIA are working on the OpenShell Reference Architecture, built around an open-source sandbox runtime: an isolated environment where agents run with guardrails and operational monitoring.

Below that software boundary, NVIDIA’s Sentry security framework runs on BlueField data processing units—processors that handle infrastructure work separately from the server’s main computing tasks. Sentry uses NVIDIA’s DOCA Argus software to monitor workloads from a separate hardware security domain, rather than placing all monitoring inside the system being watched.

SiliconANGLE reports that Argus inspects selected structures in the host’s memory to observe processes, files and network activity. It does not require monitoring software on the host. An integrated security system can use those alerts to trigger BlueField policies that isolate an affected workload. Red Hat says Sentry can quarantine a compromised agent in milliseconds.

The architecture builds on BlueField-3 support in Red Hat OpenShift 4.22, separating server CPU workloads from networking and security services on BlueField’s Arm processors. When host access is restricted, that separation helps protect infrastructure controls even if the host is compromised. Moving those services also leaves more host CPU capacity for AI work.

An agent shouldn't be enforcing its own boundaries — those controls belong outside the agent, in the runtime and the infrastructure beneath it.

John Fanelli, vice president, Enterprise Software, NVIDIA

Governing access without running the model

The model-serving side follows a similar separation of responsibilities. A joint reference design combines Model-as-a-Service access controls and an AI Gateway with software that performs inference—the work of generating model outputs. That execution layer includes vLLM, llm-d, NVIDIA Dynamo and NVIDIA NIM microservices, alongside GPU orchestration.

• Model discovery: The implementation, based on NVIDIA’s Inference Hub design, lets users find models through a self-service interface.
• Access policies: Fine-grained rules govern who can use models, while rate limits constrain usage.
• Entitlement tracking: Subscription-based records track access rights, alongside quota management and cost attribution.

Access governance is separate from model execution. The companies say that arrangement is intended to preserve throughput and predictable response times across hybrid-cloud environments while maintaining operational control. It also gives enterprise teams ways to assign costs and enforce quotas without making those functions part of the model’s own work.

The update also includes support for NVIDIA Nemotron models, including Nemotron 3.5 Super VL, in vLLM and Red Hat AI Factory with NVIDIA. Red Hat highlights quantization, which reduces numerical precision, and speculative decoding, which accelerates output generation. It says its optimized model checkpoints reduce inference latency while retaining accuracy.

Hardware readiness and the unfinished integration

Red Hat Enterprise Linux for NVIDIA now supports NVIDIA Vera CPUs. For the upcoming Vera Rubin infrastructure, Red Hat is targeting operating-system and platform compatibility when the hardware becomes available. That is a hardware-readiness commitment, distinct from saying Vera Rubin systems are already available through this announcement.

The operating-system approach limits hardware-specific changes to a small set of core packages while retaining standard RHEL userspace and security controls. Once the hardware patches mature and enter the upstream Linux kernel, users can move to mainline RHEL without reinstalling, according to the operating-system explanation described by SiliconANGLE.

Red Hat says the joint use cases, reference designs and agent capabilities are available through partners including Cisco, Dell Technologies and Lenovo. But native OpenShell integration into Red Hat AI and Red Hat AI Factory with NVIDIA is still in progress. The available designs and the planned built-in platform capability are not the same delivery milestone.