NVIDIA: AI Security Must Be Engineered Across Every Layer of the Agent Stack

Artificial intelligence security is increasingly becoming an engineering challenge rather than a problem that can be addressed by model behaviour alone.

In a September 21, 2026 article, NVIDIA security executive Saša Zdjelar argues that secure AI systems need defined security requirements, enforceable controls, accountable ownership and evidence that those protections work. The article focuses particularly on AI agents, which can reason, use tools and adapt their actions based on the information they encounter.

NVIDIA's central argument is that traditional security principles remain relevant as AI systems become more capable. Identity, access control, exposure management and verification still matter, but they must now be applied across systems in which AI models can interact with tools, data, services and infrastructure.

AI agents expand the security boundary

Traditional applications already depend on multiple components, including code, data, identities, services and infrastructure. NVIDIA describes AI agents as extending this environment because agents can use tools and respond to information encountered during execution.

The company describes three broad parts of the agent stack:

• Models provide AI capabilities.

• Harnesses organise context, tools and workflows.

• Runtime environments provide the infrastructure in which actions execute.

Security therefore cannot be concentrated at the model layer. Controls need to exist across the stack as instructions, data and actions move between components.

NVIDIA illustrates this with a customer-record scenario. An agent could encounter malicious instructions inside an attachment and attempt to send customer information to an unauthorised destination.

In that situation, the agent's reasoning should not be the only security mechanism. NVIDIA says network policy should prevent the unauthorised transfer, while protected logs should record the attempted tool call, authorisation decision and outcome.

The example also demonstrates the principle of least privilege. Permission to update a customer record should not automatically provide permission to export that data. An agent may request additional access, but NVIDIA says it should not be able to authorise that access itself.

Security boundaries need to operate independently

NVIDIA argues that a security boundary should continue to hold even when an AI agent makes an incorrect decision.

This means the environment in which an agent operates must impose restrictions independently of the agent's reasoning. NVIDIA specifically highlights controls around files, network destinations and processes.

Instructions and safeguards can influence how an agent behaves, but they are not substitutes for enforceable boundaries.

The article recommends giving each agent a traceable identity and credentials restricted to its assigned task. Organisations should also define which information agents can access, which systems they can modify and which actions require approval.

For consequential actions and permission changes, NVIDIA says human approval remains necessary.

This approach also extends to the software and tools an agent uses. Teams need to verify the source and integrity of agent tools, skills and dependencies. If an incident occurs, protected records of tool calls, authorisation decisions and outcomes can help investigators reconstruct events.

NVIDIA also highlights the need for procedures that allow organisations to revoke access and contain incidents.

NVIDIA points to OpenShell as one implementation

NVIDIA's article identifies OpenShell as an open source secure runtime designed to enforce policies outside the agent's reach. The company says it provides sandboxed execution while governing how agents access data, networks and system resources.

The article also identifies work by members of the Open Secure AI Alliance. NVIDIA says Cisco's DefenseClaw adds a governance layer, while JFrog integrates with OpenShell to scan and verify agent skills and enforce policies controlling which skills agents can access.

These examples illustrate NVIDIA's broader position that agent security should be implemented through multiple technical and governance layers rather than relying on the model alone.

Security needs evidence, not assumptions

Another major theme in NVIDIA's article is security validation.

Before deployment, engineering teams should have evidence that controls can prevent an agent from obtaining credentials outside its authorised scope or sending sensitive information to an unauthorised destination.

Testing should also examine whether an agent can modify permissions or interfere with monitoring. NVIDIA says these tests should be repeated after material changes to models, tools or workflows.

The company also stresses accountability. A named owner should use test results to determine whether a system is ready for deployment and ensure that failed tests lead to corrective action.

This creates a continuous feedback loop:

Test → Identify failure → Reproduce → Investigate → Fix → Retest → Add regression test

A security failure discovered during testing or operation can therefore become a repeatable test for future releases.

AI can also become part of the defensive workflow

NVIDIA says defenders need tools suited to the specific task, data and environment.

The article distinguishes between open and closed AI models. NVIDIA describes closed models as providing managed capabilities and services, while open models can give defenders greater ability to inspect relevant components, adapt strategies and operate infrastructure they control.

According to the article, that control can be useful during incident investigation because security teams may need to reproduce a failure and test a fix against their own systems while keeping sensitive evidence within their environment.

NVIDIA also argues that capable AI can assist security teams with finding vulnerabilities, validating fixes and investigating attacks. However, the article says the value of these systems should be assessed through reproducible findings, verifiable fixes and accelerated response time.

The company gives several examples, including Capital One's VulnHunter for AI-powered code security and ReversingLabs' Spectra Assure for AI-powered analysis of software packages to detect malware and tampering.

Additional details were not disclosed in the announcement about comparative performance between these tools or their effectiveness across different enterprise environments.

Open research and shared security practices

NVIDIA's final argument concerns collaboration.

The company says sharing evidence about what failed, which controls worked and how fixes were verified can help other organisations strengthen their own AI systems. NVIDIA points to its AI security research and the Open Secure AI Alliance as mechanisms for sharing research, tools and expertise with the wider security community.

The underlying approach is straightforward: security practices become more useful when organisations can reproduce findings, test protections and learn from documented failures.

What this means for organisations building AI agents

Analysis: NVIDIA's article highlights a broader shift in how organisations are approaching agentic AI security. As agents gain the ability to interact with business systems and external tools, security architecture increasingly has to account for actions taken by an AI system, not simply the information generated by a model.

For enterprises, this could mean treating an AI agent more like a software identity operating within a controlled environment than like a standalone chatbot.

Several practical principles emerge from NVIDIA's discussion:

1. Give agents distinct identities.
   Agent credentials should be traceable and limited to the tasks they are intended to perform.

2. Separate permissions from reasoning.
   The agent should not be able to expand its own privileges.

3. Enforce controls outside the model.
   Runtime, network, process and data controls should remain effective even when an agent behaves incorrectly.

4. Verify tools and dependencies.
   Organisations need visibility into the software, skills and tools agents rely on.

5. Protect operational evidence.
   Tool calls, authorisation decisions and outcomes can support investigation and incident response.

6. Continuously test material changes.
   Changes to models, tools and workflows can require security validation.

7. Turn failures into repeatable tests.
   Security findings can become regression tests that help verify future releases.

AI security is becoming an engineering discipline

NVIDIA's position is that AI security should be treated as an engineering responsibility with defined requirements, enforceable boundaries, accountable ownership and measurable evidence.

The article does not claim that a particular control or product eliminates AI security risks. Instead, it presents a layered approach in which model behaviour, runtime enforcement, identity, permissions, monitoring, testing and incident response work together.

As organisations deploy increasingly capable AI agents, the security question is therefore expanding from "What can the model generate?" to "What can the agent actually do, under which permissions, and what evidence exists when something goes wrong?"

That distinction is important because an agent's ability to reason or follow instructions does not, by itself, constitute a security boundary.

NVIDIA's broader message is that secure agent deployment requires engineering controls that remain enforceable when the system encounters unexpected or malicious inputs. Open research, defensive tooling and continuous testing can then help organisations improve those controls as their AI systems evolve.