Every few months the AI conversation finds a new bottleneck. First it was GPUs, then power, then data pipelines. This week in Berlin the bottleneck had a different shape: trust. Enterprises have plenty of agent prototypes. What they lack is a way to let those agents loose on real systems without losing sleep, and a place to run them that does not take two years to build
Looking across what VAST and its partners announced this week, I see one story told from four angles: governed agents, a faster path for builders, AI data centres that ship on a truck, and confidential computing you can actually prove. Let me take them in turn, and then explain why I think they belong together.
1. The governed agent: a sandbox is only half the answer
Here is the uncomfortable truth about agents. A human employee who makes a bad call has a manager, a review and consequences. An agent has none of that, and you can clone it a thousand times before lunch. So the industry has converged on sandboxing: give the agent a cage with exactly the doors it needs, and nothing else.
VAST and NVIDIA have now published a reference design for that cage, the VAST Foundation Stack for Governed Agents. It layers NVIDIA NemoClaw blueprints (which work with Hermes, LangChain, OpenClaw or your own harness), the NVIDIA OpenShell secure runtime, optional NVIDIA Sentry enforcement on BlueField-4 DPUs in Vera Rubin systems, and the VAST AI OS underneath.
Figure 1 — How responsibilities split across the governed-agent stack
The part I find most interesting is not the cage, it is what happens to the agent’s work. A sandbox is ephemeral by design; you want to tear it down the moment the task ends. But the agent’s progress, its scratch data, its memory and the record of what it did must outlive the sandbox. Otherwise you can neither resume work nor answer the auditor’s question: what did it do, and why?
VAST CTO Alon Horev put it well this week: sooner or later, every enterprise running agents in production will have to explain what an agent did and why. An agent may live for a few minutes and spawn thousands of others before it vanishes, but its work and its reasoning have to stay readable long after.
That is precisely the line VAST draws. Execution stays disposable; state lives in the data layer. In practice:
Figure 2 — Ephemeral execution above, durable state below
From where I sit, coming from many years of block storage, this is a satisfying turn of events. Clones and snapshots used to be how we protected databases and spun up dev/test copies. Now the same primitives become the substrate for agent lifecycles. Old tools, new tenants. The deployment automation is planned as a public GitHub repository, so teams can reproduce it in their own environments rather than take it on faith. VAST is also showing a governed multi-agent workflow live at the show, for anyone who wants to see the sandboxes come and go.
2. The builder stack: months shrink to an afternoon
This governed-agent stack is the third in a series. VAST already has Foundation Stacks for enterprise research assistants built on NVIDIA Nemotron, and for video intelligence built on NVIDIA Cosmos and the Video Search and Summarization blueprint. That video stack leads straight into the second story.
The second thread is about the people who build AI apps. VAST has been running the Builders Challenge, single-day events where developers create working video-AI applications. The trick is that the heavy lifting is already done before anyone sits down: Cursor provides the coding agent and platform skills, NVIDIA Cosmos does video reasoning on CoreWeave GPUs, and the VAST AI OS holds the video, runs ingestion and contextualisation, and hosts the application services.
Figure 3 — The builder stack: developers describe, the stack delivers
What came out of those days is a nice reminder of how broad the demand is: tools that find gaps in robotics training data, scan cycling footage for road hazards, automate infrastructure inspection reports, and edit video through plain-language instructions. None of these is a toy, and each would traditionally have taken a team weeks just to plumb.
The honest caveat, which Brian Verkley and Ram Bansal make themselves on the Shared Everything podcast, is that the prototype is the easy part. Production still means bigger datasets, more scenarios and real evaluation of non-deterministic output. Speed does not remove that work; it just gets you to it sooner. I would argue that is exactly the right trade.
3. The AI data center that arrives on a truck
Now zoom all the way out to the physical layer. Abu Dhabi-based Hyperfusion came out of stealth this week with Sentinel, a full AI data centre built and commissioned in a factory inside a single 45-foot high-cube container. The reference configuration carries 96 GPUs and roughly two to three petabytes of data, and it can be owned outright or run as a managed service, on-premises, in-country or fully air-gapped. For bigger footprints, HyperPod extends the same idea to 5 MW pods scaling to about 20 PB each.
Hyperfusion’s CEO frames the problem bluntly: enterprises with budget in hand still wait 18 to 24 months for data centre capacity. VAST co-founder Jeff Denworth sees the same shift from the other side: buying GPUs is no longer the hard part; finding a place to plug them in is. Organisations can often get accelerators faster than the power, cooling and floor space to run them. Sentinel goes wherever there is power. VAST’s AI OS is planned as the preferred data platform, and because Sentinel and HyperPod sites can share one global namespace, every new box joins the estate instead of becoming another island. Technical validation is still in progress, and pricing and lead times are not public yet, so treat this as a direction rather than a datasheet.
This fits a pattern. Back in June, Megaport, now a distributed compute and connectivity platform after acquiring Latitude.sh, chose the VAST AI OS and DataSpace to give customers consistent data access across on-premises, cloud and edge. Different companies, same insight: AI infrastructure is spreading out, and the data layer is what keeps it coherent.
Figure 4 — Distributed sites stitched together by one data namespace
4. Confidential AI you can verify
The last piece is the one regulated industries care about most. Encryption has always protected data at rest and in flight, but during inference the model weights and the data sit decrypted in CPU and GPU memory. For a bank, a hospital or a ministry, “trust the operator” is not a compliance strategy.
Cisco and Fortanix showed how this is being closed at NVIDIA GTC Berlin 2026. Fortanix Confidential AI now supports CNCF Confidential Containers, and the principle is simple: verify, then decrypt. Keys are released only after a composite attestation confirms that CPU, GPU and software all match policy. Change anything and the workload cannot decrypt.
The VAST angle is that Fortanix also built the attestation and key-management layer inside VAST DataEnclave. That gives customers two doors into one trust model: run models next to the data on the platform with DataEnclave, or run your own Kubernetes apps and agents with Fortanix and CoCo. Either way, the same evidence goes to the auditor, and all of it sits on Cisco Secure AI Factory with NVIDIA. The governed-agent stack explicitly builds on DataEnclave as well, which ties this section back to the first.
Figure 5 — One attestation model, two ways in
Why these four stories are really one
Put the pieces next to each other and a picture emerges. Confidential computing protects the model and the data. Sandboxes and OpenShell govern what the agent may do. The data layer remembers what it actually did and keeps its work alive between runs. The builder stack shortens the road from idea to agent. And Sentinel, HyperPod and partners like Megaport put all of it wherever the power and the data happen to be.
Agents are leaving the lab. The interesting question is no longer whether they work, but whether we can run thousands of them, everywhere, and still explain every action afterwards. That is an infrastructure question, and this week the answer got noticeably more concrete.
Related on Lots of Data: From VM Sprawl to Agent Sprawl · VAST AI OS API Hub · Anthropic, Scion, and Git