AI Security Is an Engineering Problem — How to Solve It at Every Layer of the Agent Stack

NVIDIA Blog 09/21/26, 02:51 PM News

ai-security agent-stack engineering nvidia openshell secure-ai-alliance

Summary

The article discusses AI security as an engineering problem, emphasizing the need for security controls across all layers of the agent stack and introducing tools like NVIDIA OpenShell to enforce policies.

<div id="bsf_rt_marker"></div>AI security is an engineering problem. That means defined security requirements, enforceable controls, named owners and evidence that protections work. As AI becomes more capable, the industry must accelerate security engineering, broaden access to defensive tools and share what works faster. <h2>Technology Changes, Security Fundamentals Endure</h2> The internet and cloud computing changed how software operates, while core security responsibilities endured: establish identity, control access, limit exposure and verify that protections work. AI agents introduce new capabilities — reasoning, using tools and adapting actions based on the data they encounter. Those capabilities require applying established principles to new operating conditions. This pace creates pressure. Organizations want the productivity benefits of AI while the practices to govern and secure these systems are still developing. <h2>Security Depends on the Full Agent Stack</h2> Applications depend on code, data, identities, services and infrastructure. Security depends on how those components work together — and AI agents <a target="_blank" href="https://developer.nvidia.com/blog/where-security-fits-in-an-ai-agent-stack/">extend that system</a>. Models provide capabilities; harnesses organize context, tools and workflows; and runtime environments provide the infrastructure within which actions execute. Each part of that stack carries security responsibilities, and proper protection requires controls across each layer, as data, instructions and actions move through the system. Consider an agent updating a customer record. Say it encounters malicious instructions in an attached document and attempts to export customer data to an unauthorized destination. A network policy should block the transfer, and protected logs should capture the attempted tool call, authorization decision and outcome so the security team can identify the tool used and the destination it attempted to reach. Permission to update a customer record should not automatically extend to exporting that data. An agent can request additional access, but it cannot authorize that access itself. <h2>Build Security Into How Agents Operate</h2> A security boundary has to hold even when an agent makes the wrong decision. The environment where an agent runs determines what it’s allowed to do, and must therefore install limits on files, network destinations and processes independently of the agent’s reasoning. Instructions and safeguards can help guide behavior, but security also requires enforceable boundaries. Each agent needs a traceable identity and credentials limited to its assigned task. Organizations need clear policies defining what information agents can access, which systems they can change and which actions require approval. Within those boundaries, consequential actions and permission changes still require human approval. Teams also need to verify the source and integrity of the tools, skills and dependencies agents use. If something goes wrong, protected records of tool calls, authorization decisions and outcomes help investigators reconstruct what happened. Clear procedures for revoking access and containing incidents make that evidence actionable. <a target="_blank" href="https://build.nvidia.com/openshell?nvid=nv-int-solr-662458-vt53&_gl=1*18jmge8*_gcl_au*MjEyMzE0NzgxOS4xNzg4MjE0MjE4Li0uLS4xNzg4MjE0Mjc3LjE3NzIyOTMxNy4xNzg5NjcwMDk0LjE3ODk2NzAxMTA.">NVIDIA OpenShell</a> is an open source, secure runtime that enforces policies outside of the agent’s reach and provides sandboxed execution while governing how agents access, data, network and system resources. <a target="_blank" href="https://secureaialliance.org/">Open Secure AI Alliance</a> partners are building on OpenShell: <a target="_blank" href="https://blogs.cisco.com/ai/cisco-announces-defenseclaw">Cisco’s DefenseClaw</a> adds a governance layer, and <a target="_blank" href="https://investors.jfrog.com/news/news-details/2026/JFrog-Delivers-Trust-Layer-for-AI-Driven-Software-with-NVIDIA/default.aspx">JFrog</a> integrates with OpenShell to scan and verify agent skills and enforce policies on which skills agents can access. <h2>Engineering Teams Need Evidence of Security</h2> Before deployment, teams need evidence that proper controls block attempts to obtain credentials beyond an agent’s scope or send sensitive data to an unauthorized destination. Testing should also cover attempts to change permissions or interfere with monitoring, and be repeated after material changes to models, tools or workflows. A named owner must use those results to decide whether the system is ready for deployment and ensure failed tests lead to corrective action. Failures discovered in testing or operation should be reproduced, investigated and addressed. Each finding can then become a repeatable test, allowing teams to check that the fix continues to work in future releases. Examples include CrowdStrike’s <a target="_blank" href="https://www.crowdstrike.com/en-us/press-releases/crowdstrike-launches-frontier-models-for-cybersecurity-with-nvidia/">SafeMind</a> for testing and strengthening defenses through repeated attack simulations, and Palo Alto Networks <a target="_blank" href="https://www.paloaltonetworks.com/blog/2026/06/reinventing-security-for-the-agentic-nvidia-ai-factory/">Prisma AIRS</a> for continuous red teaming as models and applications change. <h2>Defenders Need the Right Tools at the Right Time</h2> Investigating failures requires capable tools suited to the task, data and environment. Open and closed models serve complimentary needs. Closed models offer managed capabilities and services, while open models give defenders options to inspect relevant components, adapt strategies and work on infrastructure they control. During an incident, that control can help a team reproduce a failure and test a fix against its own systems while keeping sensitive evidence within its environment. Capable AI can support this work by helping find vulnerabilities, validate fixes and investigate attacks. Its value should be assessed through reproducible findings, verifiable fixes and accelerated response time. Examples include Capital One’s <a target="_blank" href="https://www.capitalone.com/tech/open-source/announcing-vulnhunter/">VulnHunter</a> for AI-powered code security, and ReversingLabs’ <a target="_blank" href="https://www.reversinglabs.com/solutions/secure-software-release">Spectra Assure</a> for AI-powered analysis of software packages to detect malware and tampering. <h2>Shift the Advantage Toward Defenders Through Open Work</h2> Sharing evidence of what failed, which controls worked and how fixes were verified helps other teams strengthen their own systems. <a target="_blank" href="https://research.nvidia.com/ai-security">NVIDIA’s security research</a> and the Open Secure AI Alliance support that exchange by bringing research, practical tools and expertise into the broader security community. AI security is an engineering problem. Every agent deployment needs enforceable boundaries, an accountable owner and evidence that its protections work. Open research and shared tools help more defenders meet that standard and improve it as capabilities advance. Learn more about <a target="_blank" href="https://research.nvidia.com/ai-security">NVIDIA’s security research</a> and join the <a target="_blank" href="https://secureaialliance.org/#join">Open Secure AI Alliance</a>.

Original Article

View Cached Full Text

Cached at: 09/21/26, 02:55 PM

# AI Security Is an Engineering Problem — How to Solve It at Every Layer of the Agent Stack Source: [https://blogs.nvidia.com/blog/ai-security-agent-stack/](https://blogs.nvidia.com/blog/ai-security-agent-stack/) AI security is an engineering problem\. That means defined security requirements, enforceable controls, named owners and evidence that protections work\. As AI becomes more capable, the industry must accelerate security engineering, broaden access to defensive tools and share what works faster\. ## **Technology Changes, Security Fundamentals Endure** The internet and cloud computing changed how software operates, while core security responsibilities endured: establish identity, control access, limit exposure and verify that protections work\. AI agents introduce new capabilities — reasoning, using tools and adapting actions based on the data they encounter\. Those capabilities require applying established principles to new operating conditions\. This pace creates pressure\. Organizations want the productivity benefits of AI while the practices to govern and secure these systems are still developing\. ## **Security Depends on the Full Agent Stack** Applications depend on code, data, identities, services and infrastructure\. Security depends on how those components work together — and AI agents[extend that system](https://developer.nvidia.com/blog/where-security-fits-in-an-ai-agent-stack/)\. Models provide capabilities; harnesses organize context, tools and workflows; and runtime environments provide the infrastructure within which actions execute\. Each part of that stack carries security responsibilities, and proper protection requires controls across each layer, as data, instructions and actions move through the system\. Consider an agent updating a customer record\. Say it encounters malicious instructions in an attached document and attempts to export customer data to an unauthorized destination\. A network policy should block the transfer, and protected logs should capture the attempted tool call, authorization decision and outcome so the security team can identify the tool used and the destination it attempted to reach\. Permission to update a customer record should not automatically extend to exporting that data\. An agent can request additional access, but it cannot authorize that access itself\. ## **Build Security Into How Agents Operate** A security boundary has to hold even when an agent makes the wrong decision\. The environment where an agent runs determines what it’s allowed to do, and must therefore install limits on files, network destinations and processes independently of the agent’s reasoning\. Instructions and safeguards can help guide behavior, but security also requires enforceable boundaries\. Each agent needs a traceable identity and credentials limited to its assigned task\. Organizations need clear policies defining what information agents can access, which systems they can change and which actions require approval\. Within those boundaries, consequential actions and permission changes still require human approval\. Teams also need to verify the source and integrity of the tools, skills and dependencies agents use\. If something goes wrong, protected records of tool calls, authorization decisions and outcomes help investigators reconstruct what happened\. Clear procedures for revoking access and containing incidents make that evidence actionable\. [NVIDIA OpenShell](https://build.nvidia.com/openshell?nvid=nv-int-solr-662458-vt53&_gl=1*18jmge8*_gcl_au*MjEyMzE0NzgxOS4xNzg4MjE0MjE4Li0uLS4xNzg4MjE0Mjc3LjE3NzIyOTMxNy4xNzg5NjcwMDk0LjE3ODk2NzAxMTA.)is an open source, secure runtime that enforces policies outside of the agent’s reach and provides sandboxed execution while governing how agents access, data, network and system resources\.[Open Secure AI Alliance](https://secureaialliance.org/)partners are building on OpenShell:[Cisco’sDefenseClaw](https://blogs.cisco.com/ai/cisco-announces-defenseclaw)adds a governance layer,and[JFrog](https://investors.jfrog.com/news/news-details/2026/JFrog-Delivers-Trust-Layer-for-AI-Driven-Software-with-NVIDIA/default.aspx)integrates with OpenShell to scan and verify agent skills and enforce policies on which skills agents can access\. ## **Engineering Teams Need Evidence of Security** Before deployment, teams need evidence that proper controls block attempts to obtain credentials beyond an agent’s scope or send sensitive data to an unauthorized destination\. Testing should also cover attempts to change permissions or interfere with monitoring, and be repeated after material changes to models, tools or workflows\. A named owner must use those results to decide whether the system is ready for deployment and ensure failed tests lead to corrective action\. Failures discovered in testing or operation should be reproduced, investigated and addressed\. Each finding can then become a repeatable test, allowing teams to check that the fix continues to work in future releases\. Examples include CrowdStrike’s[SafeMind](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-launches-frontier-models-for-cybersecurity-with-nvidia/)for testing and strengthening defenses through repeated attack simulations,andPalo Alto Networks[Prisma AIRS](https://www.paloaltonetworks.com/blog/2026/06/reinventing-security-for-the-agentic-nvidia-ai-factory/)for continuous red teaming as models and applications change\. ## **Defenders Need the Right Tools at the Right Time** Investigating failures requires capable tools suited to the task, data and environment\. Open and closed models serve complimentary needs\. Closed models offer managed capabilities and services, while open models give defenders options to inspect relevant components, adapt strategies and work on infrastructure they control\. During an incident, that control can help a team reproduce a failure and test a fix against its own systems while keeping sensitive evidence within its environment\. Capable AI can support this work by helping find vulnerabilities, validate fixes and investigate attacks\. Its value should be assessed through reproducible findings, verifiable fixes and accelerated response time\. Examples includeCapital One’s[VulnHunter](https://www.capitalone.com/tech/open-source/announcing-vulnhunter/)for AI\-powered code security, andReversingLabs’[Spectra Assure](https://www.reversinglabs.com/solutions/secure-software-release)for AI\-powered analysis of software packages to detect malware and tampering\. ## **Shift the Advantage Toward Defenders Through Open Work** Sharing evidence of what failed, which controls worked and how fixes were verified helps other teams strengthen their own systems\. [NVIDIA’s security research](https://research.nvidia.com/ai-security)and the Open Secure AI Alliance support that exchange by bringing research, practical tools and expertise into the broader security community\. AI security is an engineering problem\. Every agent deployment needs enforceable boundaries, an accountable owner and evidence that its protections work\. Open research and shared tools help more defenders meet that standard and improve it as capabilities advance\. *Learn more about*[*NVIDIA’s security research*](https://research.nvidia.com/ai-security)*and join the*[*Open Secure AI Alliance*](https://secureaialliance.org/#join)*\.*

AI Security Is an Engineering Problem — How to Solve It at Every Layer of the Agent Stack

Similar Articles

How Autonomous AI Agents Become Secure by Design With NVIDIA OpenShell

What does a practical AI agent security workflow look like?

Companies using agent security tools, are your agents even usable?

I think most AI agents are less secure than their builders realize

Security on the path to AGI

Submit Feedback

Similar Articles

How Autonomous AI Agents Become Secure by Design With NVIDIA OpenShell

What does a practical AI agent security workflow look like?

Companies using agent security tools, are your agents even usable?

I think most AI agents are less secure than their builders realize