NVIDIA's OpenShell Offers a Sandboxed Runtime for Autonomous AI Agents

OpenShell is an NVIDIA open-source project that aims to give autonomous AI agents a safer, more private place to run. The project describes itself as a runtime for fleets of agents.

The idea starts from a simple point. Agents are most useful when they can read files, install packages, call APIs and use credentials. But that also means they can reach data, secrets and networks you may not want them to touch. OpenShell says it gives agents those abilities without unrestricted access. You write a policy saying what each agent can touch, and OpenShell enforces it.

The project says it does this in two ways. First, it enforces policy at the kernel level, the core of the operating system. Each agent runs in an isolated sandbox. Kernel controls limit which files it can open and which system calls it can make. Every network connection goes through a policy check before it leaves the sandbox.

Credentials get special handling. According to the project, agents never see real credentials. OpenShell adds them only to requests headed for approved endpoints.

Second, OpenShell uses formal verification, a method of mathematically checking what a rule change would allow. Before a policy change is approved, the system flags risky new access, such as reaching a new host with credentials or calling a new API method. Those changes then wait for human review.

The project notes new features in the 0.1.x line: a stable release cadence, new isolation primitives, a wider extension surface and new APIs. It points readers to a 0.1.0 upgrade guide.

To try it, you need Linux, macOS on Apple Silicon, or Windows with WSL 2, which is marked experimental. You also need Docker, Podman or host virtualization. An install script sets up the command-line tool and a local gateway. A single command then creates a sandbox. The default sandbox image is minimal Ubuntu with no agent installed.

The project's walkthrough runs an agent called OpenCode against a free OpenRouter model. It also shows how to approve new access as the agent asks for it. The docs cover sandboxes, policies, credential providers, gateways, Kubernetes deployment with Helm and extension points such as middleware and interceptors. For Kubernetes, the cluster's network layer must enforce NetworkPolicy.

There are SDKs for Python, TypeScript, Go and Rust. They connect applications to an OpenShell gateway but do not install the command-line tool. The project advises using the same release for the SDK and the gateway when possible. It also offers public agent skills that teach a coding agent to use the CLI, write policies and debug gateways.

OpenShell collects anonymous telemetry, limited to operational categories and counts. The project says it does not collect sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. Telemetry can be turned off with a setting on the gateway, or compiled out entirely.