NVIDIA OpenShell: the open-source runtime that sandboxes fleets of AI agents, and what it actually enforces

NVIDIA OpenShell is an open-source runtime, released under the Apache 2.0 license, that runs autonomous AI agents inside sandboxes and decides what each one may touch: which files, which programs, which network destinations and which credentials. NVIDIA's documentation describes it as a runtime "for executing fleets of autonomous AI agents in sandboxed environments with kernel-level isolation." NVIDIA presented it on March 16, 2026, alongside the NemoClaw stack it announced at GTC. Version 0.1.5, published on GitHub on October 20, 2026, is the latest release in both the repository and the documentation as of October 23. It's part of a wider push, covered in our agent security coverage, to put limits on agents outside the model rather than in its prompt.

This story is based on the OpenShell GitHub repository and its releases, NVIDIA's OpenShell documentation (architecture, support matrix and 0.1.0 upgrade guide), NVIDIA's developer blog posts of March 16 and September 28, 2026, NVIDIA's September 28 press release and Canonical's June 1 announcement, checked October 23, 2026. NVIDIA's September launch was first summarized in The Week in AI #2.

The short version

• What: a runtime that sits between an agent and your machine or cluster. Policies are written in YAML; OpenShell enforces them outside the agent's process.
• How: Landlock for files, seccomp to intercept network and DNS calls, a non-root agent with no capabilities, and a network fence whose only exit is a trusted supervisor.
• Credentials: agents see placeholders. The supervisor adds the real secret only to requests bound for endpoints the policy approves.
• Agents: NVIDIA's docs name Claude Code, OpenCode, Codex and GitHub Copilot CLI. You install them in your own container image.
• Status: version 0.1.x, which NVIDIA calls "a stable release cadence." v0.1.5, released October 20, is the latest. Windows support is experimental.

What does OpenShell isolate, and how?

OpenShell splits each deployment into a trusted side and an untrusted side. Its architecture page describes three parts:

• Gateway: the control plane. It creates sandboxes, delivers policy, stores credentials ("providers") and runs a policy prover.
• Supervisor: on the trusted side. It "checks requests against policy, supplies credentials, resolves DNS, opens approved connections."
• Sandbox: on the untrusted side, with the agent. It identifies which program made a request and reports it, but "never makes policy decisions."

When an agent opens a connection or looks up a domain, seccomp intercepts the call, the sandbox passes it to the supervisor, and the supervisor checks it against policy before opening the real connection. The container or VM runtime builds an outer fence that "denies all network egress from the workload except its protected connection to the supervisor."

Last verified: October 23, 2026

NVIDIA's September 28 blog post says a credential approved for one service is rejected anywhere else, and a read-only policy can block writes even when the token itself has write access. When a request is blocked, the agent can propose a narrower rule, but "the agent cannot approve its own request."

The policy prover, added in 0.1.0, uses formal verification to flag risky changes, such as a new host that would receive credentials. "It is deterministic. It is mathematical reasoning. So this is not LLM as a judge," NVIDIA's Ali Golshan told The New Stack on September 28. In NVIDIA's own adversarial tests, agents spent up to two hours trying to persuade an AI reviewer to grant write access to a protected GitHub repository, and no protected writes occurred, the company says. That is a vendor-reported result; NVIDIA hasn't published the test setup.

Which agents and platforms does OpenShell support?

NVIDIA's documentation lists Claude Code, OpenCode, Codex and GitHub Copilot CLI as agents that can run with constrained file and network access. The September 28 blog post names Codex, Claude Code, Pi and Hermes. The default image, a minimal Ubuntu 24.04, ships with no agent installed, so you build your own image with the agent CLI inside.

According to the support matrix, host platforms are:

• Linux (Debian or Ubuntu) on x86_64 and arm64: supported
• macOS on Apple Silicon with Docker Desktop: supported
• Windows with WSL 2 and Docker Desktop: experimental

Sandboxes can run on Docker, Podman, Kubernetes (via a Helm chart) or microVMs built on libkrun. A one-line script installs the CLI and a local gateway; Canonical also announced an Ubuntu snap on June 1, 2026. The gateway sends anonymous telemetry by default, which can be turned off with OPENSHELL_TELEMETRY_ENABLED=false.

How did OpenShell get here?

OpenShell milestones

1. 2026-03-16NVIDIA presents OpenShell alongside NemoClaw, announced at GTCConfirmed
2. 2026-06-01Canonical announces an OpenShell snap for UbuntuConfirmed
3. 2026-09-28NVIDIA announces version 0.1.0 with the policy prover and launches its Open Agent Safety PlatformConfirmed
4. 2026-10-20Version 0.1.5 is published on GitHub as the latest releaseConfirmed

On September 28, 2026, NVIDIA made OpenShell the software half of its Open Agent Safety Platform. The hardware half is Sentry, an "out-of-band watchdog" on BlueField-4 DPUs that NVIDIA says can quarantine an agent in milliseconds. Sentry isn't open source, and NVIDIA's Justin Boitano told The New Stack that "the DPU is really optional." NVIDIA's press release lists Anthropic (for Claude Managed Agents), SpaceXAI, Salesforce, SAP, Red Hat, Canonical and SUSE among companies building with it. OpenAI wasn't on the partner list, The New Stack noted.

Version 0.1.0 was published on GitHub on September 25, three days before the announcement, and 0.1.1 through 0.1.5 followed, the last on October 20. The 0.1 series also broke compatibility. NVIDIA's upgrade guide says 0.0.x installations "cannot be upgraded in place," removes the built-in provider profiles and drops the earlier openshell inference commands.

How does it compare with the sandboxes built into coding agents?

OpenAI's Codex documentation says Codex uses macOS's Seatbelt framework and, on Linux, bubblewrap, with modes from read-only to danger-full-access. Its Auto-review feature hands sandbox-boundary approvals to a reviewer agent, which OpenAI says "is not a deterministic security guarantee." OpenShell's pitch is different: enforcement sits outside the agent's process and applies the same policy whichever agent runs inside. How those built-in sandboxes behave is covered in our case against unattended agents and our Codex explainer.

Sandboxes can be bypassed. An outside red team of OpenAI's internal monitoring found a way Codex agents could "in principle" bypass Codex sandboxing and Auto-Review, described in our story on that red team. No comparable independent audit of OpenShell has been published. And a sandbox doesn't fix a vulnerable agent on its own: exposed control interfaces, like the Archon flaw in our stolen API keys story, sit outside what a runtime policy covers.

What's confirmed, reported and uncertain

• Confirmed (NVIDIA docs, repository): the architecture, isolation mechanisms, supported platforms and runtimes, Apache 2.0 license, telemetry setting and v0.1.5 (October 20) as the latest release on GitHub and in the docs.
• Vendor-reported: the adversarial-test result for the policy prover and Sentry's millisecond quarantine.
• Uncertain: how OpenShell holds up under outside scrutiny; no independent security audit of it has been published.