NVIDIA OpenShell

Status: Open source, version 0.1.x. Introduced as an early preview at NVIDIA GTC in March 2026; still pre-1.0.

The idea: limits the agent cannot argue with

The usual way to keep an AI agent out of trouble is to tell it. “Don’t touch production.” “Only edit files in this folder.” “Never send data outside the company.” Those instructions help, but they are requests to a model, and models can misunderstand, forget, or be talked out of them by text hidden in a web page or a file.

OpenShell takes a different approach. It splits the job in two. The agent decides what it wants to do. A separate runtime decides what the agent is physically able to do, and enforces that decision outside the agent’s own process. Compare these two:

Instruction: “Don’t access the production database.”

Runtime policy: the sandbox has no network route to the production database.

The first depends on the model behaving. The second holds even if the model is confused or compromised. That is the core of an action boundary, and OpenShell is a concrete implementation of it for developer and enterprise agents.

What the runtime controls

Each agent runs in its own sandbox. By default nothing is allowed; permissions come only from policy, written in declarative YAML that can live in version control and go through code review.

Filesystem: reads and writes are limited to allowed paths, enforced with Linux Landlock. This is fixed when the sandbox is created.

Network: unauthorized outbound connections are blocked. NVIDIA says policy is evaluated per request down to the binary making the request, the destination, the HTTP method, and the path. Network policy can be changed while the sandbox runs.

Processes: the agent runs under an unprivileged identity, with seccomp filters blocking privilege escalation and dangerous system calls.

Credentials: the agent sees opaque placeholders instead of real secrets. OpenShell resolves them only for requests going to endpoints a provider profile authorizes. Credentials can be attached, rotated, and revoked at runtime. This means a coding agent can call an approved model API without ever holding the API key, which pairs naturally with the zero-trust idea behind credential brokers for personal agents.

NVIDIA also describes an audit trail of allow and deny decisions, which gives you a record of what an agent tried to do, not just what it succeeded at.

The gateway and the policy prover

A gateway acts as the control plane: it manages sandboxes, their policies, and access, and can run many sandboxes at once. Locally it installs alongside the CLI; on Kubernetes it deploys with Helm, as long as your network plugin enforces NetworkPolicy.

The policy prover is the less common part. Before you approve a policy change, it uses an SMT solver (a formal verification tool) to check whether the new policy grants access outside a boundary you define, and flags risky additions for a human to review. NVIDIA is careful about the limits: the guarantee covers the policy features the prover models, and a passing check does not prove a policy is appropriate for the task. VentureBeat reported that the prover does not yet cover every policy feature.

Model and framework independence

OpenShell does not care which model or agent you use. NVIDIA’s docs name Claude Code, OpenCode, Codex, and GitHub Copilot CLI as agents that can run with constrained file and network access, and the tutorial uses OpenCode with a model from OpenRouter. You can use the default Ubuntu image or bring your own container. Private enterprise setups with self-hosted model endpoints are an explicit use case.

It runs on Linux and Apple Silicon Macs, with Windows via WSL 2 marked experimental, and needs Docker, Podman, or host virtualization. NVIDIA has said it plans support on Ubuntu, Windows, and Red Hat OpenShift, plus integrations into SAP and ServiceNow, and named Cisco, CrowdStrike, Google Cloud, Microsoft Security, and TrendAI as security partners. Those are announced plans and partnerships, not shipped features you can verify today.

Who it is for

OpenShell is aimed at engineers and platform teams who want to let coding or operations agents do real work without handing them the host machine or the company network. Typical cases: running an autonomous coding agent against a repo with no route to production, giving an agent access to one internal API and nothing else, or keeping policy in Git so security can review changes like any other code.

It is not a consumer tool. If you want a personal agent with built-in safety, products like Claude Duet or Meta Muse make those decisions for you, with less control.

Limitations

• Young software. Pre-1.0, with frequent changes. Plan for upgrades.
• Policy quality is on you. A sandbox with a permissive policy is not much safer than no sandbox. Start from deny-all and add only what a task needs; our AI permission hygiene guide covers the habits.
• It does not judge intent. OpenShell limits capabilities. It cannot tell whether an allowed action is the right one, so you still need approval steps, an authorization gate, for consequential actions inside the allowed space.
• Linux-first. Kernel features like Landlock and seccomp are central to the design.
• Vendor security claims. NVIDIA’s statements that agents cannot leak credentials even if compromised are design goals. Independent security reviews are the better evidence.

Alternatives and related tools

• Cua, open-source sandboxes and infrastructure for computer-use agents controlling full desktops
• Ona, persistent cloud development environments for running software agents
• 1Password for Agents, a credential broker for personal agents that keeps passwords out of the model
• Omnara, an open-source managed agent platform with approvals and scoped secrets

Background reading: agent sandboxes, effective permissions, credential brokers, agent runtime isolation, AI Agent Sandboxes Explained, and the AI Agent Security Checklist.