When an AI agent makes a wrong turn during a task, the failure rarely announces itself with a crash or error message. Instead, the agent keeps working, quietly heading in the wrong direction until the final output is unusable. This shift from deterministic code to autonomous decision-making is forcing developers to rethink how they debug AI systems.
Tracing Decisions, Not Just Errors
Nvidia is backing a new industry effort called the Secure Agent Findings Exchange, or SAFE, designed to share lessons learned when AI agents fail in production. The initiative, supported by roughly 140 companies, borrows from the established model of vulnerability disclosure in traditional software.
“When we find these vulnerabilities, it’s not just for one company,” said Adel el Hallak, Nvidia’s vice president of product, in an interview with The New Stack. “It’s for everyone to patch across.”
Unlike conventional software, where developers can trace a failure to a specific exception or service outage, AI agents can change course mid-task. They choose their own tools, adapt their approach, and sometimes decide to “get creative” when they shouldn’t. This makes it difficult to pinpoint the root cause of a failure.
“It’s not enough to just look at the logs or the inputs and the outputs,” el Hallak said. “It is important to figure out how it got to the answer. What were the reasoning traces? What tools did it utilize? Where did it get stuck? Where did it decide to try a new approach?”
Nvidia’s OpenShell agent runtime captures much of this information by managing sandboxing, policy enforcement, and execution visibility. El Hallak described OpenShell as the one non-negotiable component across Nvidia’s reference architectures, regardless of the model or harness being used.
The company breaks the agent stack into three layers: the model provides intelligence, the harness orchestrates work, and the runtime governs execution. When an agent fails, the model itself may not be what went wrong.
Harness vs. Model
Nvidia’s NOAH research demonstrated that changing the harness while keeping the underlying model fixed can significantly improve agent performance. This suggests that a poorly matched harness can undermine even capable models.
“Every model’s different. Some could be more chatty than others,” el Hallak said. “Making sure those two things are either co-developed together or have profiles that are specific to models is a new unlock.”
Nvidia CEO Jensen Huang has framed AI safety as an engineering problem, akin to traditional software testing. “If there’s a bug in your software, you don’t release it,” el Hallak said. “You work until it’s fixed and it passes all your tests.”
But agents complicate this model. Reproducing a failure often requires reconstructing what happened across the entire system, from model output to tool usage. That level of instrumentation comes at a cost. OpenAI has found that monitoring adds roughly 20% to inference compute for its most capable persistent agents.
Nvidia’s approach combines governed harnesses, sandboxed runtimes, and confidential computing to protect both models and user data. “There are ways where you make guarantees all the way down to the silicon,” el Hallak said.
CrowdStrike is one company putting this philosophy into practice, fine-tuning Nvidia’s Nemotron models on years of security data to create paired agents—one that finds exploits and another that patches them. If either agent goes wrong, the final output may not reveal why. A bad patch, for example, could stem from the model, the agent’s execution path, or the tools it used along the way.
Read Also: AI firms prioritize infrastructure over model improvements
“I don’t need general purpose for a given task. I need specialization,” el Hallak said.
As companies build agents around increasingly specialized workflows, failures may not surface in general-purpose benchmarks or safety tests. This puts added pressure on developers to understand what happened during execution, not just whether the outcome was correct.
For platform teams, identifying a failure is one challenge. Reconstructing enough of the agent’s behavior to understand its cause is another. SAFE aims to make those findings useful beyond the company where they originated, ensuring that no team has to discover the same failure on its own.
Specialized Agents, Shared Lessons
Even well-performing agents fail often. Development teams building agents for security, DevOps, or customer support report that top-tier models still miss the mark on more than 60% of real-world tasks. The issue isn’t always the model—it’s the journey the agent took to reach its conclusion.
That mindset is shaping how companies design their agents, moving away from one-size-fits-all models toward tightly scoped systems trained on domain-specific data.
These domain-specific agents operate inside workflows that general benchmarks can’t reflect. A coding agent built for financial compliance may pass every public test yet still fail in production, simply because it wasn’t tested against the nuances of banking regulations or legacy systems.
That’s where SAFE steps in. By collecting anonymized failure reports from participating companies, it helps teams avoid repeating mistakes already discovered elsewhere. The system mirrors how security researchers share zero-day vulnerabilities—before every organization has to learn the hard way.
OpenShell plays a key role in this process. Built as part of Nvidia’s NemoClaw platform, it provides the runtime layer that logs agent behavior without slowing things down. Every tool call, every reasoning step, becomes part of a replayable trace that developers can examine after a failure.
“You can change whatever harness you need. I’m even open to using whatever models you need,” el Hallak said. “But the governance, the secure and open runtime that we want to leverage at all times is OpenShell.”
Confidential computing further hardens the stack. By encrypting data in use, not just at rest or in transit, it ensures that sensitive inputs remain protected even during agent execution. This matters most in regulated industries like healthcare and finance, where exposing raw data could carry legal consequences.
SAFE does not prescribe fixes. Instead, it catalogs what went wrong, how it was caught, and what steps led to resolution. Other contributors can then adapt those insights to their own setups, reducing redundant debugging cycles across the ecosystem.
Tracing decisions rather than just errors remains the core challenge. As agents grow more autonomous, their failures become harder to predict, and harder to fix without shared context.
