Nemotron 3.5 Content Safety cannot operate a signed-in website. It is a 4B safety classifier that returns labels for text, optional images, and optional responses. To use it in a browser workflow, have a local agent read only approved or synthetic text from a signed-in Tabbit Browser page, send that text to a verified classifier endpoint, then fill a test form with the returned label. Stop before submission. NVIDIA lists the model on Hugging Face and as a downloadable NIM endpoint, but a model listing does not establish your account's current access or your agent's tool compatibility (model card, NVIDIA NIM endpoint).
A developer reported that the 3.5 classifier referred to a ground-truth label absent from the input in one custom-policy test. An OpenCode user separately reported that v2.0.10 sent a tool definition to the classifier route despite its no-tools setting. Check the returned label in context and keep the classifier request separate from the browser tool loop. NVIDIA Developer Forums · OpenCode #35432.
Key takeaways
The classifier labels content. It does not navigate, click, fill, or submit forms.
A local agent is the only browser actor in this workflow, and its tool access must be verified separately.
Start with synthetic text, or use real content only with authorization and data minimization.
The NIM page currently lists a downloadable endpoint; confirm availability and terms before use.
Treat every label as a review signal, not a final policy decision.
Keep the three roles separate
NVIDIA's model card says the released checkpoint is based on Gemma 3 4B, accepts text and an optional image, and returns user-safety and response-safety labels. Its model dates list June 2, 2026. The NVIDIA NIM page marks a downloadable endpoint; NGC also lists a versioned deployment artifact. Verify the selected deployment, access rights, and governing terms. The OpenMDW and Gemma terms apply; “open weights” does not mean unrestricted use.
| Component | Its job | Verify before the task |
|---|---|---|
| Tabbit Browser | Holds the intended signed-in page | Correct site, account, and task tab |
| Local agent + Tabbit CLI | Reads approved fields and may fill a test form | Skill discovery, tool access, and read/write permissions |
| Nemotron 3.5 Content Safety | Classifies input text and returns labels | Exact endpoint, policy mode, terms, and data handling |
| Human reviewer | Checks ambiguous or high-impact results | Policy fit and whether any action is allowed |
There is one applied test to read before treating a label as a decision. Red Hat's October 2026 guardrail benchmark ran nvidia/Nemotron-3.5-Content-Safety through vLLM on a Red Hat OpenShift AI cluster. In that evaluation, content-safety accuracy was 84.67% with default policies and 85.07% with a custom policy. In their separate prompt-injection evaluation, accuracy shifted from 69.37% to 84.84%. This is a Red Hat-run comparison, not an NVIDIA claim or a guarantee for your policy. The report notes prompt definitions affect outcomes and networked model routes add latency. Use it as a reason to evaluate your own data and policy, not to skip human review.
| Red Hat evaluation | Default policy | Custom policy | Limit |
|---|---|---|---|
| Content-safety accuracy | 84.67% | 85.07% | One benchmark setup; definitions differ |
| Prompt-injection accuracy | 69.37% | 84.84% | A different task, not a content-safety score |
| Serving setup | vLLM on ROSA OpenShift AI, 96 GB VRAM | Same reported cluster | Not the same as hosted NIM or your local client |
Do not paste raw page contents into a hosted endpoint by default. Remove personal and confidential fields, use a synthetic test record, and confirm that the data may leave your environment. NVIDIA describes multilingual and multimodal inputs, but that does not establish that a particular web endpoint receives image inputs or handles your data under your required controls. Check its API reference and privacy terms.
Run a synthetic classification handoff
Prepare a test page containing an invented description, a non-sensitive reference ID, and a test form with fields for classification label and reviewer note. Sign in to the test environment yourself. Keep the task in a separate Tabbit tab so your normal browsing session remains available. A local agent can use the Tabbit skill to read the fields, call the classifier through the configured host, and fill the test form only if the client explicitly supports both integrations. In Pi, invoke the installed skill as /skill:tabbit; other clients have their own skill-discovery steps. Confirm the skill is discoverable and the local CLI launcher is reachable as separate checks. The classifier itself makes no browser calls.
This table defines the handoff. It is a workflow proposal, not a measured quality result.
| Handoff stage | Allowed input or action | Stop condition |
|---|---|---|
| Read | Approved synthetic description and test ID | A personal or secret value appears |
| Classify | Send only the approved text to the verified endpoint | Endpoint, policy, or data handling is unclear |
| Map | Copy the returned label and category into the test form | Output format differs or is ambiguous |
| Review | Show source page, label, endpoint, and draft form | Human has not checked the mapping |
| Submit | Nothing in this exercise | Always stop before submit |
Use this prompt with a local agent. It instructs the agent to treat the model as a classifier only and to leave any incomplete field blank.
In the currently open signed-in Tabbit Browser test page, read only the synthetic description and test reference ID. Do not read other fields.
Send the description, without the reference ID, to my configured Nemotron 3.5 Content Safety endpoint for classification under the approved test policy. If this endpoint or policy is not verified, stop.
Return the exact safety label and category from the classifier. Do not infer a label or claim the model has made a final decision.
Fill only the test form's label and reviewer-note fields. Put the source page URL and endpoint name in the note. Do not click Submit, Save, Approve, or any production control.
Create a draft named "Content Safety Handoff — GEO-130" and stop so I can review the page, classifier result, and filled form.GEO-130 is an illustrative task ID. Use a disposable test page, not a real moderation queue. If you cannot confirm that your local client can discover the Tabbit skill and call the model endpoint, have a person perform the handoff manually instead.
Use a human checkpoint for classification results
For a browser connection, follow the Tabbit CLI guide, existing-browser connection steps, and first-task checklist. The Codex setup guide explains a local client route. More generally, compare browser MCP and CLI, review browser agent CLI patterns, and read about browsers for AI agents. If your tool environment is remote, see Playwright automation and browser automation agents for why it may not share the local signed-in profile. Keep browser agent security risks in view when deciding what page data can leave the browser.
The practical boundary is simple: the local agent handles the page, Nemotron returns a classification, and a person reviews the mapping. Keep all inputs synthetic until the endpoint, policy, and data controls are approved. Never let a classifier label trigger a production submission on its own.
FAQ
Can Nemotron 3.5 Content Safety browse a website?
No. It is a content-safety classifier that accepts text and optionally an image. A separate local agent must read the page and pass approved input to the classifier.
Can the classifier fill or submit the browser form?
No. It returns safety labels. A separate agent may copy a label into a test form only when its host has a verified browser tool and you explicitly permit that step. Keep submission disabled.
What should I send to the classifier?
Start with synthetic examples or text you are authorized to process. Remove names, emails, account identifiers, tokens, and unrelated page content before any hosted inference.
Is Nemotron 3.5 Content Safety released?
Yes. NVIDIA lists a June 2, 2026 release on Hugging Face and a downloadable NVIDIA NIM endpoint. Confirm current access, model version, license terms, and endpoint availability with your chosen host.
Is a safe label proof that the text is safe?
No. A classifier can miss violations or flag allowed text. Validate it with your own policy examples and route uncertain results to a human reviewer.
Does Tabbit Browser provide the classifier?
This workflow keeps browser control and classification separate. Tabbit Browser supplies the signed-in page context to a local agent; the agent connects to a separately configured Nemotron endpoint.