NVIDIA OpenShell: a secure sandbox runtime for autonomous AI agents

What it's about

NVIDIA has published a project on GitHub called OpenShell, a "secure, private runtime for fleets of autonomous AI agents." The basic idea: agents are most useful when they can read files, install packages, call application programming interfaces (APIs) and use credentials. But that is exactly what makes them risky. OpenShell aims to enable these capabilities without giving the agent unrestricted access to your data, secrets or network. You define in a policy what each agent may touch, and OpenShell enforces it. The software is released under the Apache 2.0 license. According to a note in the README, version 0.1.x brings a stable release cadence, new isolation mechanisms, more extension points and new APIs.

How it works

OpenShell controls agents in two ways. First, it instruments the kernel (the core of the operating system) to enforce the policy at runtime on every file access, every system call and every network connection. Second, it uses formal verification, meaning mathematical proof techniques, to work out what a policy change would allow before it is applied.

• Kernel-level enforcement: Each agent runs in an isolated sandbox. Kernel controls limit which files it can access and which system calls it can make. Every network connection goes through a policy check before it leaves the sandbox.
• Credentials stay hidden: Agents never see the real credentials. OpenShell adds them only to requests to approved endpoints. An agent can't leak keys or send them to foreign servers, because it doesn't know them.
• Verified policy changes: Before a change is approved, formal verification flags risky new access, such as a new host with credentials or a new API call. Such changes wait for human review.

The architecture consists of a gateway (the control plane for sandboxes, policies and access), a supervisor and the sandbox. For policy review, there is an "Advisor" and a "Prover."

Installation and building blocks

You need Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman or host virtualization. Installation runs via a script (curl … | sh), after which openshell sandbox create --name demo creates a sandbox. The default image is a minimal Ubuntu with no agent installed. As an example, the documentation runs the OpenCode agent with a free OpenRouter model and shows how to grant new access as needed.

Other building blocks, according to the README:

• Sandboxes with images, runtimes, GPU support and lifecycle management
• Policies for filesystem, network and processes
• Providers: credentials that only work at approved endpoints, including inference
• Kubernetes operation via Helm (the CNI network plugin must enforce NetworkPolicy)
• Extensibility through middleware, interceptors and compute drivers
• "Agent Skills" for coding agents, installable with npx skills add NVIDIA/OpenShell, which teach the agent to use the CLI, write policies and debug gateways

SDKs and telemetry

Applications connect to a gateway through SDKs: Python (uv add openshell), TypeScript (@nvidia/openshell-sdk via GitHub Packages), Go and Rust. The SDKs don't install the CLI; SDK and gateway should use the same version where possible.

OpenShell collects anonymous telemetry, limited to operational categories and counts. According to the README, it doesn't capture sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or any user content. You can turn it off with OPENSHELL_TELEMETRY_ENABLED=false on the gateway (with Helm: server.telemetryEnabled=false) or by compiling it out.

Our take

Autonomous agents that run code and talk to services are a growing security problem: a misguided or manipulated agent can leak data. An approach that keeps credentials away from the agent and enforces policies addresses this head-on. What stands out is the use of formal verification for policy changes. What the source doesn't tell us is how well this works in practice: there are no benchmarks, no independent security audits and no figures on performance overhead. The 0.1.x version number and experimental Windows support show that the project is still young. The README also includes a disclaimer: the software is provided "as is," and you must assess the security and suitability of any loaded material yourself. It's worth a look for teams that want to run agents in a controlled way. If you only use a coding agent occasionally, simpler container setups may be enough.