28% of Enterprises Are Getting Consistent Returns from AI — a Year Ago That Number Was Nearly Zero

Source: NVIDIA | Published: 2026-08-03T21:10:37Z

NVIDIA's OpenShell keeps security policies outside the agent sandbox by design: agents are built to accomplish tasks, and any policy placed inside the sandbox would simply get modified to clear the way.

An Agent Is Not Just a Model

Jensen Huang has a frequently cited slide that reads: Agent = Harness + Model + Skills.

Most people still think of an "agent" as simply a very smart model. But that equation says something different: every time you type something into a chat interface, you're not triggering a large language model — you're triggering a complete system. The harness orchestrates the workflow, managing context, permissions, and observability. The model is the "brain," handling reasoning and planning. Skills are callable external capabilities — anything from generating a PowerPoint deck to accessing a highly specialized domain knowledge base like NVIDIA's CUDA-X libraries.

That system typically runs multiple models, not a single frontier model. The more specialized the task, the more likely a fine-tuned open-source model is to outperform the frontier alternative — in accuracy, efficiency, and cost.

"Persistent, Autonomous, Self-Evolving"

Three keywords define what an agent actually is.

Persistent means the agent has memory and context — it remembers what you asked last week, knows your preferences, and proactively surfaces options B and C while answering A. Autonomous means you can hand it a complete project, let it do the research, critique its own output, and return results — no back-and-forth required. Self-evolving means it can recognize a skill gap and go out and acquire what it needs — if you ask it to wrap up a research project into a slide deck, it doesn't need to be trained for that; it just pulls in the right skill.

NVIDIA's decision to expose its CUDA-X library as a callable agent skill follows exactly this logic: letting domain knowledge circulate as "skills" rather than remaining siloed with individual engineers.

How NVIDIA Actually Rolled This Out

About eight months ago, at an executive meeting, Jensen said: "I want everyone in this company using AI."

What followed was deliberate and methodical: a sequence of meetings, decisions, and policies, each implemented in order. NVIDIA's agents were connected to employee email, calendars, CRM systems, and SharePoint. Employees can use them to check their own availability or see when a colleague is free — but they cannot book time on a colleague's calendar, because "taking action on someone else's calendar" falls outside the currently authorized scope.

That detail captures the rhythm of enterprise agent deployment: start with tight permissions, limit each agent to only what it needs to access, then expand gradually as testing warrants. Starting from that conservative baseline, NVIDIA now processes 4 trillion tokens per month with 99.96% availability.

Shadow AI: The New Shadow IT

Enterprise IT teams are facing a familiar challenge: employees are already using AI — they're just not going through the approved channels.

Someone uploaded a product roadmap to a public AI service. The dynamic is identical to the shadow IT problem from twenty years ago — employees find a more convenient tool, route around IT oversight, and data sovereignty quietly erodes.

NVIDIA's approach is to deploy AI services internally, under negotiated terms: data doesn't leave the company, personal information isn't used for model training, and each employee's AI workspace is isolated from everyone else's. In Anne Hecht's words:

"I uploaded my medical records to our company's AI. I know it's secure — it won't leak, and it won't go into model training. With an external service, I'd have no such guarantee."

Encoding Policy Into Architecture: The OpenShell Sandbox

The more autonomously an agent makes decisions, the harder the security perimeter becomes to enforce — and that's not a technical problem, it's an architectural one.

In March, NVIDIA released OpenShell as an open-source project. The core design principle: each agent runs in its own isolated sandbox, with skills and policies living outside the sandbox. That sounds counterintuitive, but the reasoning is clear: if policies are inside the sandbox, an agent trying to complete a task might modify those policies to clear its own path — not out of malice, but because it was designed to finish the job and lacks the judgment to recognize "this isn't something I'm allowed to do."

SAP, Google, and other enterprise platform companies are already contributing code to OpenShell. Security solutions scrutinized openly by a broad community of security experts are simply more reliable than anything built behind closed doors by a single company — that logic has been validated in the open-source world for decades.

Data "In Use"

Most data security schemes protect two states: data at rest and data in transit. Data "in use" is often overlooked — but for agents running continuously, that's precisely the most critical window.

Confidential computing closes that gap. Google is deploying Gemini on-premises through a partnership with Dell, using confidential computing to protect model weights. Apple has announced confidential computing protections for consumer data. NVIDIA is the primary driver behind extending confidential computing from CPU to GPU — and since AI inference runs on GPUs, the implications speak for themselves.

NVIDIA's "Secure Agent Workspace" reference architecture combines OpenShell with confidential computing, packaging internal IT deployment experience into reusable design patterns.

Open Source vs. Frontier Models: Not an Either/Or

The relationship between frontier and open-source models resembles that between Linux and commercial operating systems twenty years ago: both have valid reasons to exist, and both will continue developing in parallel.

Enterprises that need to deploy in air-gapped environments, teams that need full control over model weights, scenarios that require domain-specific fine-tuning — in these cases, open-source models are often the better fit. For use cases demanding maximum general capability without the overhead of maintaining model infrastructure, frontier models remain irreplaceable.

NVIDIA's Nemotron sits in the middle: it's NVIDIA's own model, but partners can run additional post-training on top of it to fit specific business contexts while reducing inference costs.

The Industry at the Same Security Table

In recent weeks, Jensen co-signed Satya Nadella's open letter on openness and transparency. NVIDIA then helped launch the Open Secure AI Alliance alongside the broader community — membership has already surpassed thirty organizations.

The alliance's core commitment: in the domain of AI safety and security, conduct research openly, share findings, and advance the technology through open-source collaboration. The scope isn't limited to the model layer — it covers the entire agent stack, including harnesses, skills, and security mechanisms. In an industry moving this fast, getting security experts from different companies collaborating inside the same open-source project is simply faster than every organization figuring it out on their own.