What happens when an AI agent with real credentials gets tricked into deleting a production database? That question sits at the center of the 2026 conversation about enterprise AI, and it explains why platforms like SUSE AI Factory and Nvidia’s OpenShell have become lightning rods for debate. The promise is enormous: agents that book meetings, move money, and patch code without a human watching every step. The risk is just as large. Every tool an agent can touch is a door, and every door needs a lock.
This article breaks down what these platforms aim to do, where the security gaps actually appear, and what teams should check before they hand an autonomous agent the keys.
Why agent security became the headline topic
Traditional software does what it is told. An AI agent decides what to do, then does it. That shift from “execute instructions” to “choose actions” is the whole ballgame. An agent reads a web page, calls an API, writes a file, and sends an email, often in a single chain of steps nobody reviewed in advance.
Security researchers have spent years documenting the core weakness: prompt injection. An attacker hides instructions inside content the agent processes, and the agent follows them as if they came from its owner. The concept is well documented in the broader literature on prompt injection on Wikipedia, and it remains unsolved in any general sense.
Now add scale. A single agent is a nuisance. Ten thousand agents, each holding tokens to internal systems, is an attack surface that most security teams have never modeled. That is why the phrase “agent security” moved from conference talks to board agendas.
What SUSE AI Factory is trying to solve
SUSE has spent decades selling the unglamorous plumbing of enterprise computing: Linux, containers, and now AI infrastructure. The pitch behind SUSE AI Factory is straightforward. Companies do not want to build an AI stack from forty disconnected open-source projects. They want a governed environment where models run, data stays under their control, and agents operate inside guardrails. (SUSE)
The practical appeal is sovereignty. Regulated industries cannot ship customer data to a vendor’s cloud and hope for the best. Running inference on infrastructure you control, with audit logs you own, is not a nice-to-have. It is a compliance requirement.
A few practical observations for teams evaluating this kind of platform:
- Start with identity, not models. The model choice changes monthly. The identity and permission model you build will outlive it. Get service accounts, scopes, and rotation right first.
- Log every tool call. Record the final answer and each intermediate step. Intermediate steps are where agents go wrong, and where audits will look.
- Assume the model can be fooled. Design so that a fooled model cannot do catastrophic damage. Least privilege beats clever prompting every time.
The mistake teams make most often is treating the agent as a chatbot with extra features. It is closer to a new employee with root access on day one. Nobody sensible does that, yet plenty of pilots do exactly that because the demo worked.
Nvidia OpenShell and the infrastructure layer
Nvidia’s role in this story is compute. Its GPUs train and run the models, and its software stack increasingly tries to own the layer where agents execute. OpenShell, as positioned in this conversation, belongs to that execution layer: the runtime where agents are sandboxed, tools are brokered, and policies are enforced close to the hardware.
The logic makes sense. If you control the runtime, you can enforce rules the model cannot argue with. A policy engine at the infrastructure level can refuse a tool call regardless of how persuasive the prompt was. That is a meaningful improvement over asking the model to behave.
The broader hardware race shapes this too. Nvidia’s grip on AI compute has made every competitor nervous, and pricing debates have followed. Analysts have questioned whether the company’s valuation leaves room for error, a theme explored in coverage of Nvidia’s forward P/E and custom chip margins. Meanwhile, the PC chip market is shifting under everyone’s feet, as discussed in reporting on the Intel and AMD stock slide tied to Nvidia’s N1X PC chip. None of this changes the security fundamentals, but it explains why so much attention lands on Nvidia’s every move.
Where the security gaps actually appear
Strip away the marketing and agent security comes down to four failure modes. Every serious breach will trace back to one of them.
| Failure mode | What goes wrong | Practical fix |
|---|---|---|
| Prompt injection | Hidden instructions hijack the agent’s goal | Treat all external content as untrusted; sandbox tool use |
| Excessive permissions | Agent holds broader access than its task needs | Scope tokens per task; rotate aggressively |
| Shadow agents | Teams spin up agents nobody inventoried | Central registry; block unregistered credentials |
| Unlogged actions | No record of what the agent did or why | Log every tool call with inputs and outputs |
The fourth row is the one that bites during incident response. When something goes wrong at 2 a.m., the question is not “which model ran?” It is “what did it touch, in what order, and with whose credentials?” Teams that cannot answer that question are flying blind.
There is a related problem that gets less airtime: non-human identity. Every agent needs credentials, and those credentials multiply fast. A useful comparison of the vendors attacking this space appears in this breakdown of Astrix vs Oasis vs Entro for non-human identity security. The takeaway from that market is simple. Agent credentials need the same lifecycle discipline as human accounts: issuance, review, rotation, and revocation.
The 2026 agent field is moving fast
The platform wars around agents have intensified. OpenAI, Meta, and others are all pushing enterprise agent products, and the feature lists are converging. A good snapshot of that competition appears in coverage of OpenAI, Meta Muse, and the enterprise agent race. For buyers, the practical consequence is that lock-in risk is real and switching costs are high.
Hardware news keeps intruding too. Reports of an Nvidia RTX 50 Super delay into 2026 matter less for data centers than for the developers building and testing agent workflows locally. And the enthusiast community keeps squeezing surprising capability out of older cards, as shown in work on the RTX 3090 BF16 unlock reaching 129.6 TFLOPS. The point for security teams: agent development is spreading beyond the data center, which means shadow deployments are spreading too.
For anyone tracking the daily churn, following AI agents news is now a full-time job. The signal-to-noise ratio is poor, but the direction is clear. Agents are becoming infrastructure, and infrastructure attracts attackers.
A practical checklist before you deploy
Security frameworks are abstract until someone has to sign off on a rollout. Here is what actually works in practice, drawn from how mature teams approach the problem.
- Inventory every agent and every credential it holds. If you cannot list them, you cannot secure them. Start the registry before the first pilot, not after.
- Apply least privilege per task, not per team. An agent that summarizes documents does not need write access to the CRM. Scope narrowly and expand only when a specific task demands it.
- Sandbox tool execution. Run agents in isolated environments where a compromised agent cannot reach production systems directly. This is where runtime platforms earn their keep.
- Log tool calls with full context. Inputs, outputs, timestamps, and the identity used. Retain long enough to support investigations.
- Test with adversarial prompts. Red-team the agent the way you would red-team a web app. Feed it malicious documents and see what it does.
- Set a kill switch. A documented, tested way to revoke an agent’s credentials in seconds. Practice using it.
The most common mistake is skipping step one. Teams pilot an agent, it works, someone ships it to production, and six months later nobody knows it exists until it breaks something. The second most common mistake is over-trusting the model’s judgment. A model that says “I will not do that” is not a security control. It is a preference. (NIST Cybersecurity Framework)
How to read vendor claims
Both SUSE and Nvidia have incentives to present agent security as solved by their platform. It is not. Platforms reduce risk. They do not eliminate it. A runtime sandbox is genuinely valuable, but it cannot fix an agent that was granted permissions it should never have had.
Buyers should ask three questions of any vendor:
- What happens when the model is compromised? The answer should describe containment, not prevention.
- Where are the logs, and who can read them? If logs live only in the vendor’s console, your incident response depends on their cooperation.
- How do I revoke access? The answer should be measured in seconds and documented in a runbook.
The honest framing is that agent security is a process, not a product. The platform is the foundation. The discipline on top of it is what keeps you out of the headlines.
Conclusion
The combination of SUSE AI Factory, Nvidia’s runtime ambitions, and the broader agent boom points in one direction: enterprises want autonomous software, and they want it inside guardrails they control. That is a reasonable goal. The danger is believing the guardrails come free with the platform.
Security fundamentals have not changed. Least privilege still works. Logging still works. Inventory still works. What has changed is the speed at which agents can act and the number of credentials floating around. Teams that build identity discipline and containment first, and chase model benchmarks second, will be the ones still standing when the first serious agent breach makes the evening news. Everyone else will be writing the postmortem.
Frequently asked questions
What is SUSE AI Factory?
It is an enterprise platform aimed at running AI workloads on infrastructure the customer controls. The emphasis is on open-source components, data sovereignty, and governance, which matters for regulated industries that cannot send sensitive data to a public cloud.
What is Nvidia OpenShell?
It refers to an execution and runtime layer for AI agents, positioned to sandbox tool use and enforce policies close to the infrastructure. The core idea is that rules enforced at the runtime level are harder for a manipulated model to bypass than instructions given in a prompt.
Can prompt injection be fully prevented?
Not in any general sense today. Prompt injection exploits the fact that models cannot reliably distinguish instructions from data. The practical approach is containment: limit what a compromised agent can reach, log everything, and assume some attacks will succeed.
Why is non-human identity a security concern for agents?
Every agent needs credentials to call APIs and reach systems, and those credentials multiply quickly. Without lifecycle management for issuance, review, rotation, and revocation, organizations end up with thousands of unmonitored accounts that attackers can target.
What should a company do first before deploying agents?
Build an inventory. List every agent, the credentials it holds, and the systems it can reach. Then apply least privilege per task and add logging for every tool call. Teams that start with the model and skip the identity work almost always regret it.
Is agent security a product or a process?
It is a process supported by products. Runtime sandboxes and policy engines reduce risk meaningfully, but they cannot compensate for excessive permissions or missing logs. The organizations that stay secure combine platform controls with ongoing operational discipline.
