At an NVIDIA conference in Berlin on October 22, 2026, CEO Jensen Huang (黃仁勳) criticized warnings that AI will destroy humanity as "facile," AFP reported. Huang argued that AI development should be pursued actively and called for responsible optimism. Earlier, NVIDIA had announced a plan to provide computing resources for AI safety research, and it had also published a reference design for isolating and monitoring the environments in which AI agents operate. Separating the debate over future catastrophic risk from the technology that prevents dangerous behavior in today's AI systems clarifies what NVIDIA's safety measures target and where their limits lie.
Criticism of "Facile Warnings" and Resources for Safety Research
According to AFP's report, Huang criticized claims that AI will end human civilization as easy assertions made to attract attention. He also argued that if people want a sustainable future, they should develop AI rather than hold it back. However, this is Huang's view of AI's future. The reported remarks did not present any new experimental results that test how large the existential risks to humanity actually are.
NVIDIA is also putting resources into research aimed at making AI safer. In an announcement on October 13, the company said it would provide computing resources worth a total of $250 million over the next five years to support AI agent safety and security research in the UK. The plan would make $50 million worth of compute available to researchers each year. In the same announcement, Huang said, "AI capability and safety must progress together."
The support takes the form of access to computing infrastructure, not a cash contribution. The compute will be delivered through NVIDIA Cloud Partners based in the UK, and the infrastructure will also be located in the country. Most of the support will go to the broader research community, with some earmarked for BOLD, led by the University of Oxford; SOFAIR, led by University College London (UCL); and research at Imperial College London. However, the providers, technical configuration and commercial terms are still to be agreed, so the announced figure cannot be equated with research funding that has already been spent.
Taken together, these remarks and initiatives show that Huang rebuts claims of AI-driven catastrophe while committing resources to research that tests the safety of more advanced AI and improves defensive technology. Still, a pledge to support safety research is not scientific evidence that future dangers do not exist.
What Is NVIDIA Trying to Control in AI Agents?
The OpenShell Reference Architecture, announced by NVIDIA on October 21, is a reference design for restricting the permissions of AI agents running in enterprise systems and monitoring their behavior. Unlike conventional chat AI, AI agents do more than generate text. They carry out tasks autonomously that involve real actions, such as rewriting files and calling external tools. As a result, safety depends heavily not only on the accuracy of the answers they generate, but also on which systems they can connect to and what they are authorized to change.
In the configuration NVIDIA presented, Vera Rubin handles the AI model's inference, and AI agents run on the Vera CPU. It also combines this with Sentry, which runs on the BlueField-4 data processor and monitors and controls the agent from a location independent of its execution environment. Rather than relying solely on the AI model to follow instructions, the approach builds control functions into the computing infrastructure itself to limit the operations an agent can perform.
The statements and materials NVIDIA released in October 2026 all relate to AI safety, but each addresses a different problem.
| Statement or publication that month | Question addressed | What can be confirmed, and limits |
|---|---|---|
| AFP report on Huang's remarks on the 22nd | Will AI end human civilization? | Huang criticized catastrophic predictions of the future. However, the remarks themselves do not scientifically establish future safety. |
| UK research support announcement on the 13th | How should AI defensive technology be researched and verified? | This is a commitment to provide computing resources. Research results and defensive effectiveness remain to be verified. |
| OpenShell reference design on the 21st | How should AI agent execution be controlled? | It presents a design combining isolation and monitoring, but it is not independent testing demonstrating effectiveness in every deployment environment. |
| Safety design document updated on the 21st | Which controls remain effective after a system is compromised or halted? | The scope of protection differs depending on where controls are applied, and operations already completed externally cannot be undone by stopping the agent. |
This table organizes the views and initiatives NVIDIA presented that month by their subject and type of evidence. It does not compare the effectiveness of safety measures or the probability of accidents using a common metric. Publishing a reference design is not the same as being able to block dangerous operations in a real operating environment, and its effectiveness will need to be verified going forward.
Isolating an AI Agent Does Not Undo Completed Actions
NVIDIA's design document on the workspace environment lists risks to defend against, including incorrect file rewrites and information leaks. One of them is "prompt injection," in which malicious instructions are hidden in documents or tool output to steer an AI agent toward unintended actions. Even when the user gives appropriate instructions, improper instructions contained in material the agent reads later may change the operations it carries out.
To address these risks, NVIDIA's design distinguishes between controls outside the workspace that manage users and connection destinations and controls over running processes and file operations. Restricting communication with the outside and limiting the operations permitted inside the environment play different roles. For example, having permission to read the contents of an email does not mean having permission to update customer information. The permissions given to an agent must be managed in detail according to the purpose of the task and the type of operation.
The method of isolating the execution environment also requires care. According to NVIDIA's explanation, ordinary containers share the host OS kernel, so if a kernel vulnerability is exploited, other workloads on the same host could be affected. For that reason, NVIDIA recommends isolation using virtual machines when running untrusted code generated by an AI model. However, adopting virtual machines alone does not complete the safety measures. Functions such as user authentication, operation approval and permission revocation must be implemented separately.
Furthermore, if the workspace OS is compromised at the administrator level, monitoring functions running in the same environment can no longer be trusted. In its security and governance model, NVIDIA limits the controls that remain effective in such a situation to those that can be applied independently from outside the compromised environment. The mere existence of monitoring features or devices does not guarantee that dangerous operations can still be blocked after a system is compromised. What matters is how independent the infrastructure that performs monitoring and control is from the environment it protects.
"Stopping" an AI agent also has several meanings. NVIDIA's document distinguishes between isolating the agent from the network, halting its processes and revoking its permissions on external services, and calls for recording the result of each. For example, if an operation the agent sent to an external service has already been accepted, stopping the agent afterward does not automatically undo the completed processing. Being able to halt a dangerous operation midway and being able to reverse changes that have already occurred are different capabilities.
Turning Optimism into Real Safety Assessments
NVIDIA's own design document treats an AI model's capabilities as a factor in assessing risk, but it does not position the model itself as a boundary that guarantees safety. Rather than assuming the model will follow instructions properly, the approach evaluates safety by combining the permissions given to the agent, its connection destinations and the data it handles. This way of thinking, separate from Huang's optimistic view of AI's future, serves as a benchmark for companies deciding whether to deploy AI agents.
What companies should actually check is whether prohibited operations are reliably blocked even when they are attempted through external tool calls or generated code. NVIDIA's document also clearly distinguishes audit-only mechanisms, which merely record violations, from mechanisms that block the actual operation. It then calls for testing both permitted and prohibited operations to verify that controls work as intended. However, strictly restricting every operation is not the answer. Companies also need to evaluate whether legitimate work can still be completed normally and whether legitimate operations are blocked by mistake.
Huang's rebuttal of predictions that AI will bring down human civilization cannot be taken as a guarantee that current AI agents are safe. The focus going forward is what reproducible research results come from the computing resources NVIDIA has promised, and how far the control technologies actually deployed can block dangerous operations and revoke granted permissions. If such results can be presented in a form that third parties can verify, the responsible optimism Huang champions could become a concrete basis for deciding which tasks companies can confidently hand to AI agents.