Nvidia Sentry's millisecond claim raises AI agent detection questions

Tech giant Nvidia's promise to quarantine rogue AI agents in milliseconds addresses an important part of enterprise security -- namely, stopping dangerous activity quickly.

However, the company's response to questions about its Sentry design reveals a critical qualification. The claim measures containment separately from detection, leaving open the extent to which an agent could accomplish damage before defenders recognize a threat.

This is a critical point. Enterprises authorize agents to retrieve sensitive information, invoke APIs and change business systems -- often through permissions the organization deliberately granted.

The company's Open Agent Safety Platform, announced September 28, combines OpenShell runtime software with Nvidia Sentry, a reference system design that enforces security outside the agent's host environment.

While that separation offers value, speed claims alone cannot establish protection against credential misuse, coordinated activity or actions already underway.

When the clock starts

"Our internal testing found Sentry can quarantine and stop an agent in milliseconds if it attempts to cross its software boundary," an Nvidia spokesperson told TechTarget.

"Detection is a separate workflow that is influenced by the runtime signals, which in some cases, can be applied in near real-time."

The spokesperson said Sentry uses hardware observability and enforcement to accelerate the interval between detection and containment.

That leaves two distinct questions for buyers: How quickly can the system identify dangerous behavior, and what exactly does quarantine prevent once triggered?

John Strand, owner of Black Hills Information Security, a U.S.-based penetration testing company, said an agent using stolen credentials might appear to be conducting legitimate activity, with no exploit signature necessarily being involved.

"The question isn't just whether containment can happen in milliseconds, it's whether we can actually identify the behavior that should trigger containment in the first place," he said.

Kevin Surace, CEO of biometric security firm Token Core, said an agent could expose credentials, invoke an API, change access controls or initiate a transaction before quarantine occurs.

"Millisecond containment is valuable, but speed alone is not enough," he explained.

Those are possible consequences, but the outcomes would depend on permissions, connectivity, the action involved and when detection occurs.

EDR comparisons need equivalent measurements

Nvidia positions Sentry as complementary to EDR and XDR systems, not a replacement. Running on Nvidia BlueField-4, it monitors agent behavior and enforces policy in silicon, independently of the agent and host software.

However, when asked for independent comparative testing, Nvidia supplied no head-to-head benchmark. Its millisecond figure does not establish that Sentry detects and contains attacks faster than EDR or XDR under equivalent conditions.

Strand said existing tools can be effective where they have endpoint visibility. His concern is the exposed services, APIs and operational environments where comparable coverage may be absent.

Aviv Nahum, co-founder and CEO of Above Security, identified another limitation: Legitimate application activity may become harmful only when viewed as a sequence.

"Existing security tools may see all the individual actions and still miss the story," he said.

Faster exploitation increases pressure

CrowdStrike's 2026 Threat Hunting Report provides context for the urgency. China-linked adversaries exploit vulnerabilities within 24 hours of public proof-of-concept disclosure, and one LLM resource-abuse campaign generated 200,000 API requests in two minutes.

Strand said he recommends compensating controls when a vulnerability cannot be fixed immediately: Restrict who can reach the service, apply firewall rules or isolate it until maintenance is possible.

Surace argued that agent defenses also need individual identities, narrowly scoped permissions, short-lived authorization and the ability to revoke access across a fleet. These controls limit what can happen before a detection system reaches its decision.

Coordinated agents complicate detection

An attacker might also distribute activity, so no individual agent triggers an alarm, with Strand offering password guessing as a hypothetical example. Multiple agents could divide attempts across accounts, systems and time rather than producing one conspicuous burst.

"Those agents could coordinate attacks specifically to stay underneath detection thresholds," he said.

Such coordination doesn't necessarily imply agents independently form malicious intentions. An attacker could orchestrate the work, exploiting gaps between controls that evaluate identities or actions separately.

Nahum said defenders should examine relationships among agents, including shared artifacts and situations in which one agent's output becomes another's instruction.

For Nvidia, that remains an area of continuing evaluation.

"Testing around coordinated and adversarial agent behavior is ongoing, and we expect to share additional findings as the work progresses," the spokesperson said.

That response establishes neither a demonstrated bypass nor proven resistance. Buyers still need evidence showing how the design handles distributed activity and what happens to delegated tasks or external requests after an agent is quarantined.

Open Interfaces Do Not Mean Hardware Parity

Nvidia's openness claims also require distinguishing the platform's components. OpenShell is open source and can be extended to third-party compute platforms, according to the announcement. Sentry's announced hardware support is narrower.

"The Sentry design announced today runs on Nvidia BlueField-4 DPUs; we are not announcing support for other hardware," the spokesperson said.

Nvidia said Sentry APIs would allow other DPU vendors to build compatible implementations. That offers a route toward alternatives but does not establish that equivalent products or protections are available today.

Nahum said he recommends checking whether policies, telemetry, identity controls and enforcement remain consistent across infrastructure -- and whether a customer can replace an enforcement layer without rebuilding the agent environment.

Given these limitations, experts said organizations should strongly consider practical deployment tests before making a purchase decision to establish which protections remain available -- not merely whether an agent or model runs successfully.

"The test for openness is not whether you can see the source code," Nahum said. "It is whether you can change the infrastructure underneath it without losing the security model."