Agents Need a Runtime Boundary, Not Just Guardrails

DeepInfra argues that AI agents require runtime-enforced security boundaries in addition to model-level guardrails as they gain access to tools, APIs, networks, and execution environments. Its Sandboxes use hardware-isolated Kata Containers microVMs with separate kernels and host-enforced network policies, while Hosted Agents similarly isolate always-on agents and restrict access through user-controlled SSH and private TLS URLs. DeepInfra is a first-party inference provider for NVIDIA OpenShell, whose gateway keeps credentials and access policies outside agent environments, and it also participates in NVIDIA’s NemoClaw ecosystem. The company reports that NVIDIA Vera CPUs supported 256 continuously busy microVM-isolated agents on 20 physical cores at its stated latency and reliability target, outperforming tested Intel systems, while emphasizing that isolation overhead should be retained for untrusted workloads. DeepInfra offers an OpenShell integration guide for running agents with its inference APIs under policies that permit its endpoint while blocking other network destinations, and says it will continue evaluating and contributing to externally enforced agent-security approaches.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.