NVIDIA OpenShell: kernel-enforced agent sandboxes with verified policy changes

An open-source runtime that sandboxes coding agents with kernel-level policy and hidden credentials, for devs giving agents real access.

Picture a two-person consultancy where one developer runs Claude Code against a client's repo most afternoons. To be useful, the agent has to install packages, run tests, hit the GitHub API and call a model endpoint, so the developer's tokens sit in a .env file the agent can read. That leaves two settings. One is to approve every command by hand, which kills the speed that made the agent worth using. The other is to let it run loose and hope it never reads the wrong directory, posts somewhere unexpected, or uses a write-scoped token when the task only needed reads. Neither option leaves a record the client would accept if they asked what the agent touched.

On September 28, 2026, NVIDIA announced its Open Agent Safety Platform. The software core, OpenShell, targets that gap. It is an open-source runtime where you declare what each agent may touch, the kernel enforces it, and the agent never holds the real credentials. The platform's hardware layer, Sentry, needs BlueField-4 DPUs, but OpenShell itself runs on ordinary Linux, Apple Silicon and WSL 2 machines (AiCybr).

What it is

Per the project README, OpenShell governs agents in two ways. It instruments the kernel to enforce policy on every file access, system call and network connection, and it uses formal verification to check what a policy change would allow before the change is applied. Mapped to the lede:

Policies are written in YAML and compiled to OPA/Rego, which OpenShell evaluates for each outbound request (NVIDIA blog). BazaarLink notes the files can live in version control. The project is Apache 2.0 and ships SDKs for Python, TypeScript, Go and Rust. BazaarLink reports that v0.1.0 shipped September 25 and v0.1.2 shipped September 28. NVIDIA's blog lists Codex, Claude Code, Pi and Hermes as supported agents, and BazaarLink says the docs also use OpenCode and GitHub Copilot CLI as examples.

Alternatives and adjacent options, described only from their sources:

Who it's for

Pick it up if you run a coding agent that needs a shell, packages and API keys but must not reach the rest of your machine or network. It also fits if you want to approve each new network destination an agent asks for, or if you run several agents and want one gateway holding their policies and credentials. NVIDIA's blog cites Cadence, Slack and Gecko Robotics as adopters, and Technobezz reports integration work at Salesforce, SAP and Scale AI. Those are vendor-reported deployments, not field reports.

Skip it for now if you need a tool with independent security validation before it touches client systems. BazaarLink found that most coverage restates the press release. Also skip it if your workflow is Windows-native, since WSL 2 support is marked experimental. And skip it if you were hoping for hardware-backed isolation on commodity machines, because Sentry requires BlueField-4.

Before and after

Today (hypothetical consultancy):

  1. Export tokens into the shell or .env, where the agent can read them.
  2. Start the agent with broad permissions, or babysit approval prompts.
  3. Hope the agent stays within the repo and uses read-only calls when it should.
  4. Reconstruct what happened from shell history if a client asks.

With OpenShell:

  1. Create a provider from your existing key. AI/TLDR's walkthrough of the first-agent guide imports an OpenRouter provider profile and notes the agent never sees the raw key.
  2. Create a sandbox with a YAML policy, attach the provider and pass the agent command.
  3. When the agent hits a wall, it proposes a rule. The prover flags risky reach, and you approve or reject from the host. ServeTheHome reports that swapping a network policy takes one command and needs no sandbox restart.
  4. Answer the client from the OCSF audit trail and openshell logs.

Try it

The README's quickstart requires Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman or host virtualization:

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo

The installer sets up the CLI and a local gateway. The default sandbox is minimal Ubuntu with no agent installed. The README points to the "Run Your First Agent" guide, which runs OpenCode against a free OpenRouter model and shows how to approve new access. BazaarLink advises reading any curl | sh script before running it.

To see enforcement without an API key, NVIDIA's blog creates a sandbox from a no-network policy and then swaps in a read-only GitHub policy:

openshell sandbox create --name policy-demo \
  --no-auto-providers \
  --policy examples/no-network.yaml

network_policies:
  github_api:
    name: github-api-readonly
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-only
    binaries:
      - path: /usr/bin/curl

Download the original policy files from the blog post rather than retyping this one, since indentation matters in YAML. The blog checks blocked requests with openshell logs policy-demo --since 5m. The README also offers agent skills (npx skills add NVIDIA/OpenShell) that teach your coding agent to drive the CLI and write policies.

On cost: OpenShell is Apache 2.0, and no pricing was disclosed (Technobezz). Anonymous telemetry is on by default. The README says it can be disabled with OPENSHELL_TELEMETRY_ENABLED=false on the gateway.

Where it breaks

Sources