NVIDIA open-sourced NOOA on July 27 alongside a 37-member Open Secure AI Alliance — but the framework is the real story here. The pitch is three words: an agent is a Python object. That sounds almost too simple. The benchmarks suggest it isn’t.
How NOOA Works: Methods Are Actions, Docstrings Are Prompts #
Every AI agent framework makes the same tradeoff: how much behavior lives in code versus prompts? LangGraph pushes you toward developer-defined graphs. LangChain stacks callbacks. Most systems split an agent’s logic across YAML configs, JSON tool schemas, prompt templates, and event handlers — a coordination surface no individual can hold in their head at once.
NOOA collapses that into a single Python class. Fields store state. Methods expose capabilities. Docstrings serve as prompts. Type annotations define what the model must return. The key division is between two kinds of methods:
Ordinary Python bodies— execute deterministically, no LLM involved** Ellipsis bodies (**— completed at runtime by the LLM-driven loop...
)
A complete support agent looks like this:
class SupportAgent(Agent):
order_db: OrderDB
def is_refund_eligible(self, order: Order) -> bool:
return order.delivered and order.days_since_delivery <= 30
@strategy(PredictStrategy())
async def classify(self, message: str) -> TicketKind:
...
is_refund_eligible
runs as standard Python. classify
is handed to the LLM, which must return a valid TicketKind
— or NOOA rejects the output and retries. The model and the developer use exactly the same object interface.
That last part matters more than it sounds. It means you can write unit tests for agent behavior the same way you’d test any Python class — no prompt template archaeology required. You can trace, refactor, and version control the harness without digging through layered callback registrations.
The Numbers: 82.2% on SWE-bench at Half the Token Cost #
The NOOA technical paper runs benchmarks across three domains. The results are hard to dismiss:
SWE-bench Verified(500 real GitHub issues): 82.2% with GPT-5.5 at ~1.1M tokens. Comparison harnesses scored 78-79% using roughly 2.2M tokens — same quality, double the spend.Terminal-Bench 2.0(terminal interaction): 73.0% vs. OpenCode’s 60.7% on the same model. The gap widens when reasoning is disabled.** CyberGym L1**(vulnerability rediscovery): 86.8% — the top-scoring open-source result on the leaderboard.** ARC-AGI-3**(interactive reasoning games): 85.1% RHAE with GPT-5.6-Sol at $13.28 per game. Raw GPT-5.6-Sol without NOOA scores 13.3%. The harness effect is 6.4x.
The token efficiency story is structural. NOOA’s pass-by-reference design means large inputs never get serialized into context — the model receives a bounded preview while the full object stays accessible in Python. Most frameworks serialize everything into the context window, burning tokens on data the model doesn’t need right now. NOOA’s median SWE-bench sessions peak at 22-72k prompt tokens; comparison systems run 200-400k.
The Memory System Is Optional — and Surprisingly Effective #
NOOA includes an optional MemoryManager
that attaches to any agent without modifying its class. It stores records in a local SQLite file with vector indexes, and recall works two ways: agents explicitly query their memory, and a BeforeTurn
hook pushes relevant records into context automatically before each turn.
On ARC-AGI-3, memory over file-based notes improved scores by +11.8 RHAE points. Winning games averaged 1.63 deliberate recalls per decision, with a correlation of p=+0.52 between recall frequency and task success. A typed knowledge graph beats a flat log file.
The Security Caveat: NOOA Is Not a Sandbox #
This cannot be buried in a footnote. NOOA can execute LLM-generated Python. The framework’s AST checks and module deny-lists are defense-in-depth controls — they protect the agent loop, not the host system.
For any production deployment, you need OS-level isolation around the agent process: containers, virtual machines, or NVIDIA’s OpenShell runtime. The paper is direct: “Sandboxing goes around agent process; shell tool no safer than in-process Python.” The ARC-AGI-3 evaluation used Landlock filesystem isolation plus seccomp network blocks, and found zero leakage across 13,335 interaction logs — but that required actual OS-level isolation, not just NOOA’s in-process guards.
The Open Secure AI Alliance: 37 Members, No Charter Yet #
The coalition includes Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation — 37 organizations in total. OpenAI, Google, Meta, and Anthropic signed a supporting policy letter but are not founding members.
Worth flagging: there’s no charter, no governing board, no shared repository, and no delivery schedule as of launch day. Initial technical contributions exist — HPE’s SPIFFE/SPIRE identity work, Hugging Face’s Safetensors format, Microsoft’s MDASH scanning harness, and NOOA itself. But 37 signatories and a framework that actually ships are different things. The Linux Foundation’s involvement suggests a governance path; whether it materializes is a question for 2027.
How to Get Started #
NOOA is available at github.com/NVIDIA-NeMo/labs-OO-Agents, version 0.0.6, under Apache 2.0. The examples/arc_agi_3
directory includes the world-model solver with fleet runner — a complete example demonstrating memory, pass-by-reference, and CodeActStrategy together.
This is a research preview, not a production framework — NVIDIA is explicit about that. If you’re building agents for production today, Microsoft Agent Framework 1.0 (GA since April) or LangGraph are the safer choices. But if you want to understand where agent harness design is heading, NOOA is worth an afternoon.
The “agent as Python object” framing isn’t just a design pattern. It’s an argument that AI agents should be first-class software artifacts: inspectable, testable, versionable, and auditable. That argument is going to get louder as enterprise agent deployments scale past the point where prompt engineering alone can govern them.