Keeping AI Agents on Task: Check Point Advances AI Agent Safety with NVIDIA OpenShell Reference Architecture

How Check Point and NVIDIA co llaborate an agent governance , control over how they run, and in-silicon security built into the AI infrastructure

Agents can go wrong without an attacker

AI agents now plan, use tools, work with sensitive data and hand work to other agents. Their value comes from doing things nobody scripted step by step. That also creates a new kind of risk: an agent can follow every rule and still do the wrong thing.

No attacker is needed. An agent can:

Access sensitive data, credentials, or internal systems

Absorb untrusted or misleading content as if it were a valid instruction

Act on that instruction through tools, external communications, or other agents

Today’s controls still matter. Isolation limits what an agent can reach. Network security limits where it can connect. Monitoring shows what it did. But an action can be allowed and still be wrong. The missing question is simple: does this step serve the task the agent was given?

What NVIDIA announced at GTC Berlin

Today at GTC Berlin, NVIDIA introduced NVIDIA OpenShell Reference Architecture for safe AI agents, a design for running agents safely at scale. Check Point is proud to be part of it. Two parts matter most for agentic security:

NVIDIA OpenShell™ is the secure runtime agents work in. It governs which files, tools and networks each agent can use. Because it is open source, Check Point is building on it and contributing back.

NVIDIA Sentry , running on NVIDIA BlueField™-4 , enforces security from a hardware-isolated domain outside the machine the agent runs on, where the agent can’t reach it, and can quarantine an agent within milliseconds.

Steering agents back on track, not just blocking them

Check Point looks at each action an agent proposes in context: the original task, what the agent has seen, the steps it has already taken and the rules that apply. That makes a smarter response possible than a simple yes or no.

An example. A procurement agent is comparing supplier proposals. Forty steps in, it gets ready to email a confidential pricing workbook to an outside address. The address is reachable and the agent is allowed to send email. But sending the workbook doesn’t match what the user asked for.

Instead of shutting the agent down, Check Point can block that one email and tell the agent why: “Don’t the workbook outside the company. Summarize the comparison using approved data and keep going.” The agent corrects course and the work continues.

This matters even more when agents work together. One agent’s mistake becomes another agent’s trusted input, and the error spreads. Catching it early, before each step compounds, prevents a much bigger failure.

Steering isn’t always the right call. Some situations need an immediate stop:

An agent attempting to break out of its sandbox

Data actively leaving the company

Repeated, deliberate rule breaking

The goal is a response that fits the risk: guide the agent when it can safely recover, and contain it when it can no longer be trusted.

How the pieces fit together

Each layer does a different job:

NVIDIA OpenShell: policy-based governance for each agent. A controlled runtime that sets which files, tools and networks an agent can use.

Check Point at the agent: is this the right action? Where OpenShell permits an action, Check Point adds additional scrutiny, checking whether it fits the agent’s task, then steers or blocks it if it doesn’t.

NVIDIA BlueField and NVIDIA Sentry add an independent enforcement layer outside the host, complementing OpenShell’s runtime protections with controls that are isolated in silicon from the agent environment.

Check Point AI Factory Firewall: protecting the infrastructure. Threat prevention and segmentation for AI infrastructure. Using NVIDIA Sentry and powered by NVIDIA DOCA™ Argus , it watches workloads from the outside and detects threats such as model tampering, credential theft, container escapes and unauthorized GPU use. It keeps working even if the workload itself is compromised.

Together, these layers solve two different problems. The first is keeping agents focused on their task. The second is making sure the infrastructure running them can be trusted.

Check Point brings these together across employee AI use, production AI applications and the infrastructure behind them. It is the direction we are building toward, and the pieces are coming together step by step.

What happens when an agent acts

The agent gets a task. Its identity, the task and the rules that apply are shared with Check Point.

The agent proposes an action. Before an important tool call, OpenShell sends it to Check Point for review.

Check Point responds to fit the risk. A normal action goes ahead. An off-task action is blocked, with a safer alternative. A clear threat triggers stronger containment.

The other layers keep working. OpenShell’s rules and infrastructure security keep enforcing on their own, even for actions Check Point can’t see.

The security team sees it all. Decisions and infrastructure signals come together for investigations and better policies.

What this means for customers

Agents keep working when a mistake can be fixed, instead of being shut down.

Serious threats are stopped fast, with containment the agent can’t reach.

Each check runs where it has the right context, without slowing agents down with duplicate checks.

Security from the agent’s task down to the hardware, from two partners built to work together.

For companies building AI factories and agent systems, this is a path to autonomy with accountability: agents that keep working when a mistake can be fixed, and controls that stop them fast when the risk calls for it.