The agents are multiplying. Security vendors are selling the leash.
SentinelOne launched agent detection and an autonomous SOC; NVIDIA pushed a governance reference architecture and confidential bare metal.
- SentinelOne unveiled Singularity ADR at OneCon 2026, now in early access, to discover AI agents, enforce their permissions, and stop rogue behavior in real time. Self-reported m:…4453
- SentinelOne says its Purple Agentic Investigation has completed more than 400,000 investigations of critical alerts and saved customers an estimated 332,000 analyst hours. Self-reported m:…0653
- SentinelOne and Lenovo expanded their partnership to bring AI security and governance to the ThinkShield security portfolio. Self-reported m:…6515
- NVIDIA's OpenShell reference architecture is designed to give organizations full-stack control to deploy AI agents with clear boundaries on what agents can access and do, per NVIDIA. Self-reported m:…5725
- NVIDIA introduced Confidential Bare Metal; Cohere plans to integrate it into its Model Vault, and Google Cloud is extending support to A4X Max instances on GB300 NVL72 systems. Self-reported m:…7242
SentinelOne's OneCon launches
SentinelOne used its OneCon 2026 customer conference to launch Singularity Agentic Detection and Response (ADR), now in early access. The offering discovers AI agents, enforces what each agent is allowed to do, monitors behavior in depth, and detects and stops unintended and malicious activity in real time, the company said. Security teams can stop a single agent mid-action without halting the rest of the workflow, and the platform inventories every agent, tool, skill, connector, and MCP server — sanctioned or not — along with the permissions each holds and the employees behind it. m:…4453
The coverage map shows where agents actually live now: Salesforce Agentforce, Microsoft Copilot Studio, OpenAI ChatGPT workspace agents, and Anthropic Claude managed agents are all in scope. The platform blocks prompt injection, jailbreaks, credential exfiltration, and tool poisoning before the action executes, and integrates with SentinelOne's Prompt Security and Purple product lines. m:…4453
The autonomous SOC
Alongside ADR, SentinelOne unveiled Singularity ASOC, an integrated suite for autonomous security operations powered by its Purple models. The suite brings agentic investigation, AI SIEM, hyperautomation, data pipelines, and case management into one offering, the company said, automating triage and correlation while keeping analysts in control of final decisions. SentinelOne says Purple Agentic Investigation has completed more than 400,000 investigations of critical alerts and saved an estimated 332,000 analyst hours, and that ASOC ships with more than 50 out-of-the-box connectors to third-party sources. The company says it protects nearly one-fifth of the Fortune 500. m:…0653
Distribution is going through hardware: SentinelOne and Lenovo expanded their partnership to bring AI security and governance to the ThinkShield portfolio, giving security teams visibility into both sanctioned and shadow AI on Lenovo endpoints, control over how data is shared, and the ability to prevent sensitive data from reaching unauthorized AI applications. Governance policies can be applied in real time, the companies said. m:…6515
NVIDIA's runtime layer
NVIDIA is attacking the same problem from underneath. Its OpenShell reference architecture is designed to give organizations full-stack control to deploy AI agents with clear boundaries around what agents can access and do, the company said — and NVIDIA BlueField-4 DPUs running NVIDIA Sentry provide in-silicon enforcement for that architecture. The stack covers Vera Rubin NVL72 for model inference, Vera CPUs with OpenShell for agent harnesses and tool use, and BlueField-4 DPUs for enforcement. NVIDIA introduced the OpenShell reference architecture to enable organizations to safely deploy agents at scale. m:…5725 m:…7242
The OpenShell governance layer sits alongside confidential computing. NVIDIA introduced Confidential Bare Metal, a new deployment option for its Confidential Computing platform, so frontier model builders can run sensitive workloads on dedicated third-party infrastructure with hardware-rooted security. Cohere plans to integrate it into its Model Vault; Google Cloud is extending support to A4X Max instances on GB300 NVL72 systems. Support now spans Grace Blackwell NVL72 and x86-based HGX and DGX Rubin NVL8 systems, with ten cloud providers and six systems vendors — Cisco, Dell, HPE, Lenovo, Supermicro, and Bull — on board. m:…7242
What it means
This is my read, not a reported fact: two philosophies are emerging. SentinelOne sells the control plane for the agents you deploy — discovery, permissions, kill switches. NVIDIA sells the runtime guarantees underneath — governed reference architectures and confidential execution. Both shipped in the same week, which suggests enterprise buyers are now asking how agents get governed during procurement, not after. For developers, the practical takeaway is that agent identity, permissions, and audit trails are becoming checklist items — the moment to design for them is before the fleet grows, not after the first incident. m:…4453 m:…5725
What is still unresolved
- Whether ADR-style discovery can keep up with agents spawned inside other agents.
- How confidential computing performance overhead affects large-scale agent inference.
- Whether agent governance consolidates into existing EDR/SIEM budgets or becomes its own line item.
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.