NVIDIA OpenShell sandboxes AI agents with kernel-level policy enforcement

NVIDIA has published OpenShell, an open-source runtime that it describes in the README as "the safe, private runtime for fleets of autonomous AI agents". The premise is that agents are most useful when they can read files, install packages, call APIs and use credentials. OpenShell is meant to give them that capability without unrestricted access to the user's data, secrets or network. The user declares in a policy what each agent can touch, and OpenShell enforces it.

The README names two ways it governs agents. The first is kernel-level enforcement: it instruments the kernel to enforce policy on every file access, system call and network connection at runtime. Each agent runs in an isolated sandbox. Kernel controls confine which files it can open and which system calls it can make, and every network connection passes through a policy check before it leaves the sandbox. Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints.

The second is formally verified policy changes. Before a policy change is approved, OpenShell uses formal verification to flag risky new access that the change would grant, such as reaching a new host with credentials or calling a new API method. Those changes wait for human review.

The README also announces what is new in the 0.1.x line: a stable release cadence, new isolation primitives, an expanded extension surface and new APIs, with a 0.1.0 upgrade guide. It gives no details beyond that one line.

For setup, the user needs Linux, macOS on Apple Silicon, or Windows with WSL 2 (marked experimental), plus Docker, Podman or host virtualization. A one-line curl installer sets up the CLI and a local gateway, and openshell sandbox create --name demo creates a sandbox. The default sandbox image is minimal Ubuntu with no agent installed. The first-agent walkthrough runs OpenCode against a free OpenRouter model and shows how to approve new access as the agent asks for it.

The documentation is organised around sandboxes (images, runtimes, GPUs, lifecycle); policies (filesystem, network and process rules, with an advisor and prover for reviewing changes); providers (credentials that work only at approved endpoints, including inference); gateways (the control plane for sandboxes, policy and access); Kubernetes deployment via Helm, which requires a CNI that enforces NetworkPolicy; extensibility (middleware, interceptors and compute drivers); and tutorials. Public OpenShell skills can be installed for a coding agent with npx skills add NVIDIA/OpenShell; they teach it to drive the CLI, write sandbox policies, and debug gateways and inference routing. SDKs connect applications to a gateway but do not install the CLI.

The project says it is built agent-first, developed with the same agent-driven workflows it enables. It collects anonymous telemetry limited to operational categories and counts, and says it does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. Telemetry can be turned off with OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs, or compiled out. The license is Apache 2.0, and the software is provided "AS IS" with a disclaimer that it retrieves external materials governed by separate terms, which the user must review.

Key facts

OpenShell is NVIDIA's open-source (Apache License 2.0) runtime for running fleets of autonomous AI agents inside isolated sandboxes, governed by a per-agent policy.
It instruments the kernel to enforce policy on every file access, system call and network connection, and every outbound connection passes a policy check.
Agents never see real credentials; OpenShell injects them only into requests bound for approved endpoints.
Formal verification checks what a policy change would allow and flags risky new access, such as a new host with credentials or a new API method, for human review.
Runs on Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), with Docker, Podman or host virtualization; the 0.1.x line is announced as new.

Why it matters

Agents that can read files, install packages and use credentials are useful but risky. OpenShell's pitch is to keep that capability while limiting what an agent can reach. Two things set it apart in the README's account: policy is enforced at the kernel level rather than only by the agent's own good behaviour, and policy changes are checked by formal verification before they take effect, so widening an agent's access is a reviewed step, not a quiet edit.

Who it affects

Teams running coding agents or other autonomous agents against real data, secrets and networks, and platform teams that would host fleets of such agents. The Kubernetes path (a Helm-deployed gateway) is aimed at shared infrastructure. Developers on Linux, Apple Silicon Macs or Windows with WSL 2 can also run it locally.

How to use it

Install with the project's curl script, which sets up the CLI and a local gateway, then run openshell sandbox create --name demo. The default sandbox is minimal Ubuntu with no agent in it, so the walkthrough has you run OpenCode against a free OpenRouter model and approve new access as the agent needs it. For Kubernetes, deploy the gateway with Helm on a cluster whose CNI enforces NetworkPolicy. npx skills add NVIDIA/OpenShell installs skills that teach a coding agent to use the CLI and write policies. The project is licensed under Apache 2.0.

How solid is it

This is NVIDIA's own README, so it shows the project's claims about itself. It gives no benchmarks, overhead figures or independent security audit results, and it does not name the kernel mechanism or the formal verification tool. No customers or production deployments are named. The 0.1.x line is announced as new, with no release date stated, and Windows support through WSL 2 is marked experimental.

Risks and caveats

The README states no limits of the protection beyond the experimental Windows status, and it does not claim the runtime is proof against every attack. Formal verification flags risky changes for human review, so safety still depends on reviewers acting on those flags. The software is provided "AS IS" without warranty, it retrieves external materials under separate terms that the user must check, and it collects anonymous telemetry by default unless the user disables it.

“OpenShell is the safe, private runtime for fleets of autonomous AI agents.”

— OpenShell README, NVIDIA/OpenShell on GitHub