How to Build Secure AI Agents Without Sending Data to the Cloud
At Computex, NVIDIA shipped a credible answer at every layer of running autonomous agents on hardware you control — silicon, OS containment, the OpenShell runtime, an open-weight model, and the agent frameworks. The headline is RTX Spark. The part that changes procurement is that agent governance just became a free, standardised commodity — which moves the durable work up to policy, workflow, and GDPR-grade audit.
On 1 June 2026, at NVIDIA GTC Taipei alongside Computex, Jensen Huang announced NVIDIA's entry into PC silicon — and, buried under the consumer headline, the thing that actually changes how a company puts agents into production: a complete software stack for running autonomous agents on hardware you control, without the agent becoming a liability. The chip got the applause. The stack underneath it is what we read twice.
Capability was never the blocker. Agents have been able to read and write files, run shell commands, browse, spawn sub-agents, and run unattended for hours since early this year. The blocker was the enforcement surface that capability creates — an agent powerful enough to be useful is powerful enough to leak a credential, exfiltrate the wrong data, follow a poisoned web page, or quietly run up an unbounded inference bill. Under GDPR, that risk profile kept agents out of production. The honest answer for most of 2026 was wait.
What was missing was not a smarter model. It was a layer between the agent and the machine that the agent cannot talk, reason, or jailbreak its way around — where the rules are set and enforced from outside the agent's reach. That is what shipped on 1 June. This is the stack, walked from the silicon up.
What shipped is a stack, not a chip
The clean way to read the announcement is as five layers, each solving a different part of "let an agent do real work on my systems safely." NVIDIA shipped a credible answer at every layer at once — that simultaneity is the news, not any single part.
The silicon makes local inference real across a price ladder. RTX Spark — NVIDIA's first PC part, built with MediaTek — carries up to 128 GB of unified memory shared between CPU and GPU. At the roughly 4-bit quantization those figures assume, that runs models up to 200B parameters on a single box (405B across two units). At the top, the DGX Station for Windows runs frontier models up to 1T parameters locally. Treat the headline counts as ceilings: real throughput depends on quantization and context length. Even so, "the agent runs on a box in your office" is now a hardware fact, not a slogan.
The OS and runtime layers are the move that matters, and we treat them as one idea: constraints enforced by the environment the agent runs in, not by the agent's own system prompt. NVIDIA and Microsoft co-developed Windows primitives for identity, containment, and policy; OpenShell is the cross-platform, policy-rich runtime built on the same principle. Everything else — the model (§03), the frameworks, the CUDA-X libraries now callable as agent skills — plugs into that. The interesting part is that secure, governed, local agent execution now has an emerging open standard.
OpenShell: the enforcement layer, in detail
OpenShell is the load-bearing layer and the part worth understanding precisely. It is an Apache-2.0 runtime for executing autonomous agents in sandboxes, first released 16 March 2026, ~89% Rust with a Python layer. Read the next sentence before you plan anything on it: it is still alpha — the project calls itself "proof-of-life," single-developer, single-environment, on the v0.0.x line. The architecture is the signal here, not the readiness.
The core decision is that policy lives outside the agent's process and is enforced underneath it. The agent decides what it wants to do; the runtime decides what it is allowed to do; those are two layers, and the agent never holds the second one — so it cannot override it. On Linux this goes down to the kernel via Landlock LSM, each agent in its own sandbox. The project's own mental model is "browser tabs for AI agents." All of it runs as a K3s cluster inside a single Docker container, which is what lets the same primitives scale from a laptop to a multi-node GPU cluster — the local case and the data-centre case are the same system at different sizes.
Defence in depth runs across four policy domains, each with a different enforcement lifetime:
- Filesystem
- reads and writes only inside allowed paths sealed at sandbox creation · cannot be loosened live
- Process
- blocks privilege escalation and dangerous syscalls sealed at sandbox creation
- Network
- blocks unauthorised outbound connections hot-reloadable at runtime
- Inference
- reroutes model API calls to controlled backends hot-reloadable at runtime
Egress is where the design earns its keep. Every outbound connection is intercepted and resolved to exactly one of three outcomes — and enforcement is at Layer 7, on HTTP method and path, not just host.
Two details close the loop on credentials. Routing for inference means the runtime strips the caller's credentials and injects the correct backend credentials itself — the agent makes the call without ever holding the key. And API keys, tokens, and service accounts are managed as providers: named bundles injected at sandbox creation as runtime environment variables, never written to the sandbox filesystem. The agent can use a credential it can never read — which is the difference between a compromised agent that is contained and one that walks out with your secrets.
The model leg is the part that decides whether any of this is real
The hardware and the runtime are inert without a model good enough to run locally — and, critically, one whose weights you are actually allowed to download and self-host. Closed frontier models (Opus, GPT, Gemini) cannot be self-hosted; they are an API call to someone else's cloud. So the local-agent thesis lives or dies on the open-weights field catching the closed frontier on the workloads that matter — chiefly coding and agentic tasks.
NVIDIA's own answer is Nemotron 3 Ultra, a 550B-parameter mixture-of-experts model built for long-running agents rather than chat, claiming frontier-level reasoning at up to 5× faster inference and ~30% lower running cost than comparable frontier models. For agents that run for hours and make far more calls than a chatbot, cost-per-token and latency compound heavily — so that economics line, if it holds, is the whole argument. Because OpenShell is model-agnostic, Nemotron is an option, not a requirement; Claude Code, Codex, OpenCode, and Copilot CLI all run inside the same runtime unmodified.
The same week sharpened the point. On 1 June, Shanghai-based MiniMax released M3, positioned as the first open-weights model to combine frontier-level coding, a one-million-token context window, and native multimodality in one system.
- SWE-Bench Pro
- 59.0 vendor-reported · said to clear GPT-5.5 and Gemini 3.1 Pro, approach Claude Opus 4.7
- Context
- 1M tokens made affordable by MiniMax Sparse Attention — ~1⁄20 the per-token compute at full context vs M2
- Price
- $0.30 / $1.20 per M tokens OpenRouter promo · ~an order of magnitude below closed-frontier coding models
Three caveats, because they are the point — and the same discipline we apply to every vendor launch:
- These are vendor numbers. They come from the company selling the model. Independent benchmarks land in the days after, and vendor comparisons routinely soften under third-party testing.
- The weights are not out yet. MiniMax promised open weights and a full technical report within ~10 days; the parameter and active-parameter counts were not disclosed at launch. Until they ship, "self-hostable" is a promise, not a fact you can act on.
- A benchmark is not a workflow. A model that scores well on SWE-Bench Pro can still behave differently on a messy multi-file change in a real internal repository. The only test that counts is whether it holds the request, inspects the right files, makes the change, verifies it, and stops — on your code.
M3 is here as evidence, not endorsement: the model leg is filling in. Whether M3 specifically is the right model is a question you answer by testing it on a real task via API, then revisiting when the weights and independent benchmarks land. The structural point stands regardless of which open model wins — capable, self-hostable models are arriving, and they are what turn the stack from an architecture diagram into something a company can deploy.
What changes for a European buyer
Three shifts follow, and the first is the one that gets agents past the procurement gate in Europe.
Local inference becomes a first-class deployment target. With RTX Spark on the low end and a trillion-parameter deskside box on the high end, "run the agent on hardware you physically control" is a real option across a price ladder, and the model side is converging at the same time. Combined with OpenShell's Privacy Router — keeping sensitive context on local compute and redacting personal data before anything reaches a cloud model — this is the most defensible architecture yet for data-residency and GDPR concerns. Architecture, not a compliance guarantee: the whole payoff turns on redaction recall, which you validate on your own data before you stake a DPA on it. A redactor that misses one PII field is a breach, not a near-miss. Treat it the way we treat MiniMax's benchmark numbers: promising, and to be proven on your workload before it goes in a contract.
The hard part of agent deployment moves up the stack. For a year the question was "can we run an agent safely at all?" That now has a converging answer, so the difficulty relocates to the decisions the runtime does not make for you: which workflows are worth handing to an agent, what each agent may touch, what "allowed" means in your compliance context, who reviews the audit trail, and how you measure whether the agent is doing the job. None of that is solved by a sandbox.
Agent governance is becoming a commodity layer. Sandboxing, policy enforcement, credential isolation, audit logging — the plumbing — is now open-source and free, with a vendor coalition standardising it: Cisco, CrowdStrike, Microsoft Security, Google Cloud on the policy side; Canonical and Red Hat on the OS and infrastructure side. When that many serious parties align on one runtime, "how you govern an autonomous agent" starts to have a default answer. The value of "I'll install and isolate your agent" collapses toward zero.
Sandboxing an agent is becoming free. Deciding what it may touch — and proving it never reached further — is the work that doesn't commoditise.
Our read
This stack is not production-ready today, and saying otherwise would be selling hype. OpenShell is alpha — proof-of-life, single-developer, breaking changes expected; the multi-tenant enterprise path (Kubernetes / Helm) is explicitly under construction and GPU passthrough is experimental. The pieces ship on a staggered timeline: NemoClaw is available now, OpenShell is an early preview, Nemotron 3 Ultra is expected 4 June, RTX Spark machines arrive in the fall. The native Windows experience is described as upcoming, not shipping.
So the posture is precise: treat this as a clear, well-funded signal of where production agent deployment is heading, and a stack worth prototyping against now — on internal, low-risk workloads — so you are not starting cold in six months. It is not a stack to rebuild client production systems on this quarter. The readiness signal to track is OpenShell's path from single-player alpha to multi-tenant enterprise; we are watching that line, not the chip launch.
What does not change is where the durable work sits. The plumbing is converging on a free, open, standardised layer — which is exactly the layer Sebrona never sold. Our work is the part the sandbox does not do: deciding which processes to delegate, authoring policy for real regulatory constraints, owning the audit and change-management around it, and choosing a model and agent that hold up on your code rather than on a benchmark slide. That work is the same regardless of which runtime or model wins, and this announcement makes it more valuable, not less. The EU-sovereign, Apache-2.0-floor posture we have argued for since the practice was founded just got a reference implementation.
If you already have agents in production and want them more reliable, cheaper, and defensible under GDPR — or you are deciding which workflows are worth handing to one — that is the work we do. Write to info@sebrona.com.
Corrections welcome. If a number, result, or claim is wrong, write to info@sebrona.com — we publish corrections with a note on the post. The MiniMax M3 figures in particular are vendor-reported and the weights were not released at the time of writing.
Reading
Where the figures in this post come from. All reflect launch-day reporting and vendor claims; verify against primary documentation before acting.
- NVIDIA GTC Taipei · Computex 2026RTX Spark, DGX Station for Windows, the NVIDIA Agent Toolkit, NemoClaw, Nemotron, and the Windows security and containment primitives.
- OpenShellApache-2.0 agent runtime · out-of-process policy, Landlock LSM, K3s-in-Docker, Layer-7 egress, providers, Privacy Router. Alpha, v0.0.x.
- Nemotron 3 Ultra550B MoE open model for long-running agents · up to 5× faster, ~30% cheaper to run (vendor).
- Hermes AgentMost-used agent by OpenRouter usage · closed self-improvement loop, persistent memory, MIT.
- MiniMax M3Open-weights coding + 1M context + multimodality · 59.0 SWE-Bench Pro. Vendor-reported; weights pending.
- Hardware coverageRTX Spark specifications and SKU range.
Sebrona internal references
What in our stack moves on the back of this announcement. Full ship log at /changelog.
- Q3 2026OpenShell evaluated as the sandbox + policy layer for on-prem client deployments with data-residency constraints. Tracking it from single-player alpha to multi-tenant before any client exposure. ADR-017 on the table.
- Q3 2026Privacy-Router pattern — local routing of PII-bearing context, sanitised egress only — folded into the reference architecture's GDPR posture.
- 04 Jun 2026JARVIS router adds Nemotron 3 Ultra as a candidate model for agentic and coding task classes, gated behind our nightly eval harness and the open-weights release.
- 09 May 2026Reference architecture v1.2 — at /tech. ADR-014 documents the orchestration-vs-integration layer re-cut behind it.