NVIDIA AI Red Team warns enterprise AI agents need hard security controls

NVIDIA's AI Red Team has published a security review of enterprise AI agents, warning that organizations are giving tool-using models access to corporate systems before surrounding them with controls that are enforced outside the model itself.

The July 30 technical blog focuses on agents that can act like digital coworkers: reading tasks, running tools, editing files, opening pull requests or contacting other systems. NVIDIA says its red team assessed multiple agents over the past six months, from interactive coding tools to always-on assistants, and repeatedly found the same failure modes when systems were exploitable.

Where the risk concentrates

The most important pattern is that an AI agent is not just a chat window once it can touch live tools and business data. NVIDIA lists weak agent access control, arbitrary code execution through tools, missing network-egress restrictions and plaintext secrets in the agent environment as recurring problems. Those issues can combine quickly: a broadly reachable agent with a shell, cached credentials and open outbound networking can become a path for data theft or persistence.

• Access to an agent should be limited to authenticated, explicitly authorized users.
• Command execution, when required, should run in a hardened sandbox with least-privilege permissions.
• Outbound network access should start from a default-deny policy and allow only task-specific destinations.
• Persistent secrets should stay out of the agent's context, filesystem and environment variables.

NVIDIA is especially direct about prompt-based defenses. The post says system prompts and LLM-as-a-judge filters can be useful signals, but they should not be treated as the first line of defense against adversarial users or malicious content. The team describes social engineering, gradual multi-turn persuasion and legitimate-looking package-installation workflows as techniques that can push agents toward unsafe behavior while appearing routine.

For developers, the practical message is architectural. Agents need the same kind of containment applied to other privileged automation: narrow identity, controlled filesystems, validated package sources, segmented networks, short-lived credentials and auditable tool permissions. NVIDIA also points to Docker, virtual machines and its OpenShell project as examples of execution isolation patterns, while cautioning that the environment must not be able to rewrite its own configuration into a weaker state.

The guidance lands as enterprises are rapidly moving from chatbot pilots to agentic systems that perform real operational work. NVIDIA's warning does not argue against deploying agents; it argues that model behavior should be assumed fallible, and that deterministic security boundaries must carry the burden when agents are connected to production data and infrastructure.

Sources

• developer.nvidia.com

Cover photo by Pixabay on Pexels, used under the Pexels License.