Every AI agent you run today holds your secrets in its process environment: API keys, cloud credentials, tokens. One prompt injection away from exfiltration — and 2026 proved it twice, with two separate compromises of the most popular LLM proxy on PyPI, in March and again this week. NVIDIA's answer landed on GitHub this week: OpenShell (Apache 2.0) — a runtime where agent fleets run in kernel-level sandboxes, never see real credentials, and where every policy change is checked by a Z3 SMT prover before a human approves it.
This is not another agent framework. It's the layer underneath: confinement, custody, and proofs for fleets of agents that already exist. I spent the evening in the repo — here's what it actually does, mechanism by mechanism.
OpenShell is three components: a gateway (the control plane), a supervisor, and sandboxes (minimal Ubuntu by default, GPU passthrough optional, Kubernetes via Helm if you're fleet-sized). The policy model covers filesystem, network, and process rules; enforcement is at the kernel — every file access, syscall, and network connection is checked at runtime, not by a wrapper library the agent could forget to call.
The quickstart is two commands, on macOS Apple Silicon, Linux, or WSL2:
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo
The default sandbox ships with no agent inside — you bring yours. The docs' first-agent walkthrough runs OpenCode against a free OpenRouter model, which means you can feel the whole thing without a paid key.
This is the inversion that matters. Today's default is: you export OPENAI_API_KEY into the agent's environment, and pray. The agent process holds the crown jewels in /proc/self/environ, one prompt injection from leaking them into whatever URL the model decided to fetch.
OpenShell's providers crate restructures custody:
Read that again from the custody perspective: the blast radius of a compromised agent stops being "every key in the environment" and becomes "the endpoints this sandbox's policy named". Your agent can still work — read files, install packages, call the APIs you approved — but the keys to everything else simply aren't in the room.
The part I didn't expect at this maturity: the openshell-prover crate is a formal verifier for sandbox policies. From its own README:
Encodes a policy + its attached credential set + a binary capability registry as a Z3 SMT model, then runs reachability queries to detect credentialed-reach and capability changes a reviewer should be aware of.
Concretely: when a policy change is proposed — by you, or by the agent itself — OpenShell doesn't just diff the YAML. It encodes the would-be state into SMT and asks reachability questions: can this sandbox now reach a new host with credentials attached? call a new API method? Risky deltas wait for human review. There's also a containment API: give it an operator boundary policy and a candidate, and it answers Within / not — with counterexamples when the answer is no.
And the failure mode is the right one: the model has bounds (ASCII literals in network selectors, no embedded NUL bytes), and when a policy uses a shape it can't model, it returns unsupported_policy_shape — "I can't prove anything about this" — instead of a green light. The crate's own guidance: treat unknown values as fail-closed. Whoever wrote that sentence has been burned before, in the good way.
If you've followed the formal-verification world this week, the timing lands: Anthropic published the same evening that LLMs are making formal verification feasible at much larger scale. Put the two together and a pattern emerges for the agent era — LLMs propose, solvers dispose: the model writes the policy, the prover holds the gate, the human signs the deltas.
Three honest limits, because a runtime named "safe, private" invites oversharing:
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo
And for the prover, the crate README carries a containment example you can build from source: a boundary policy, a candidate, check_within_boundary, and a CheckResult::Within or a counterexample. Ten minutes with the policy schema teaches you more about agent confinement than a month of threads.
Repo: github.com/NVIDIA/OpenShell · Docs: docs.nvidia.com/openshell · Apache 2.0, SDKs in Python/TypeScript/Go/Rust, skills for your coding agent (npx skills add NVIDIA/OpenShell).
TL;DR — the agent-security stack is assembling in layers this month: kernel sandboxes for confinement, gateway-held credentials for custody, SMT provers for policy review, and (from the other camp) journals and attestations for evidence. Your agent still can't be trusted. But it can finally be contained, funded, and proven — which is what "trusted" was supposed to mean all along.