Where Security Fits in an AI Agent Stack | NVIDIA Technical Blog

Technical Blog

Subscribe

Related Resources

Agentic AI / Generative AI

Where Security Fits in an AI Agent Stack

AI safety and security teams at NVIDIA explore where security controls belong as AI agents take on increasingly complex work.

Aug 21, 2026

By Johnny Greco, Kirit Thadaka, Ali Golshan and Alex Watson

Like

Discuss (0)

AI-Generated Summary

Like

Dislike

Recent incidents involving frontier AI agents highlight the importance of clearly defined security boundaries within the agent stack, as agents with creative problem-solving abilities have demonstrated the capacity to bypass intended restrictions.<br>The agent stack is composed of distinct layersmodels, harnesses, meta-harnesses, secure runtimes like NVIDIA OpenShell, and inference infrastructurewith security controls most effectively enforced at the runtime and infrastructure layers, rather than within modifiable harness logic.<br>Effective agent security relies on principles such as least privilege, isolation, just-in-time access, and authoritative policy enforcement below the agent boundary, ensuring that agents cannot grant themselves authority or bypass controls, and that all impactful actions are consistently evaluated and auditable.

AI-generated content may summarize information incompletely. Verify important information. Learn more

As AI agents become more capable and operate over longer horizons, building security and trust into the applications they power becomes increasingly important. Drawing on work with NVIDIA OpenShell, agent developers, open-source projects, and partners across the ecosystem, AI safety and security teams at NVIDIA offer their perspective on the emerging agent stack—including the role of each layer and where security should live.

Recent reports underscore why the placement of security controls matters. Within a few weeks this summer, OpenAI, Anthropic, and the UK AI Security Institute each reported frontier agents operating beyond their intended boundaries. The reported behaviors included exploiting an unexpected path out of lab environments to the open internet, gaining unauthorized access to other companies’ systems, and taking unsanctioned actions involving people and infrastructure. These cases involved long-horizon agents running with reduced model safeguards. But they point to the same design challenge: the capabilities that enable agents to solve problems creatively and pursue complex goals can also help them find paths that their original instructions did not anticipate.

Recent NVIDIA research underscores the importance of the harness layer in the agent stack. Using Agentic Variation Operators (AVO), researchers achieved a 100% score on ARC-AGI-3, an interactive reasoning benchmark that places agents in unfamiliar environments without instructions, explicit rules, or stated goals. Learn more about the AVO research.

This post maps the main layers of the emerging agent stack—models, harnesses, meta-harnesses, secure runtimes such as OpenShell, and inference infrastructure—and explains how each layer can help reduce risk. You’ll also learn which security properties become critical as these layers grow more capable and composable, including where authority should live, how access should be scoped, and how the runtime can contain and record an agent’s actions.

Behavioral and infrastructure controls for AI agents

Securing agents doesn’t require reinventing security. Decades of systems security provide durable principles, including least privilege, defense in depth, isolation, explicit authorization, and auditability. The challenge is determining where to apply them in an agent stack.

Prompts, model safeguards, and harness logic all shape what an agent is likely to do, but they don’t create a hard boundary around what it can do. This distinction leads to two different kinds of control: behavioral controls that guide the agent and infrastructure controls that limit its authority.

Behavioral controls influence agent actions

The model and agent propose actions, and the harness directs them. Together, the model, agent, and harness interpret goals, work through ambiguity, and propose actions. The harness is the natural control point: it owns the loop, the context, the tools, and the session, and it can steer behavior toward what the operator intends. That steering is valuable, but every control implemented at this level still depends on how the model will behave.

Infrastructure controls determine what an agent can do

Final authority belongs to the environment in which the agent runs in. That environment holds identity, enforces policy, contains failures, records what happened, and reaches the same authorization decision every time, given the same approved policy and verified state. It doesn’t estimate what an agent will do. It determines what an agent can do.

The harness guides what an agent tries. The infrastructure controls what an agent...