{"slug": "agents-should-never-hold-your-api-keys-nvidia-just-open-sourced-the-runtime-that", "title": "Agents should never hold your API keys. NVIDIA just open-sourced the runtime that enforces it", "summary": "NVIDIA open-sourced OpenShell, an Apache 2.0 runtime that runs agent fleets in kernel-level sandboxes so agents never hold real API keys or cloud credentials, enforcing filesystem, network and process policies at the kernel rather than through a wrapper library. The runtime includes an openshell-prover crate that encodes a proposed policy, its credential set and a capability registry into a Z3 SMT model and runs reachability queries to flag credentialed-reach or capability changes for human review, returning unsupported_policy_shape rather than approving policies it cannot model. The release follows two compromises of a popular LLM proxy on PyPI in 2026.", "body_md": "Every AI agent you run today holds your secrets in its process environment: API keys, cloud credentials, tokens. One prompt injection away from exfiltration — and 2026 proved it twice, with two separate compromises of the most popular LLM proxy on PyPI, in March and again this week. NVIDIA's answer landed on GitHub this week: **OpenShell** (Apache 2.0) — a runtime where agent fleets run in kernel-level sandboxes, **never see real credentials**, and where every policy change is checked by a **Z3 SMT prover** before a human approves it.\n\nThis is not another agent framework. It's the layer underneath: confinement, custody, and proofs for fleets of agents that already exist. I spent the evening in the repo — here's what it actually does, mechanism by mechanism.\n\nOpenShell is three components: a **gateway** (the control plane), a **supervisor**, and **sandboxes** (minimal Ubuntu by default, GPU passthrough optional, Kubernetes via Helm if you're fleet-sized). The policy model covers filesystem, network, and process rules; enforcement is at the kernel — every file access, syscall, and network connection is checked at runtime, not by a wrapper library the agent could forget to call.\n\nThe quickstart is two commands, on macOS Apple Silicon, Linux, or WSL2:\n\n```\ncurl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh\nopenshell sandbox create --name demo\n```\n\nThe default sandbox ships with no agent inside — you bring yours. The docs' first-agent walkthrough runs OpenCode against a free OpenRouter model, which means you can feel the whole thing without a paid key.\n\nThis is the inversion that matters. Today's default is: you export `OPENAI_API_KEY` into the agent's environment, and pray. The agent process holds the crown jewels in `/proc/self/environ`, one prompt injection from leaking them into whatever URL the model decided to fetch.\n\nOpenShell's `providers` crate restructures custody:\n\nRead that again from the custody perspective: the blast radius of a compromised agent stops being \"every key in the environment\" and becomes \"the endpoints this sandbox's policy named\". Your agent can still work — read files, install packages, call the APIs you approved — but the keys to everything else simply aren't in the room.\n\nThe part I didn't expect at this maturity: the `openshell-prover` crate is a **formal verifier for sandbox policies**. From its own README:\n\nEncodes a policy + its attached credential set + a binary capability registry as a **Z3 SMT model**, then runs **reachability queries** to detect credentialed-reach and capability changes a reviewer should be aware of.\n\nConcretely: when a policy change is proposed — by you, or by the agent itself — OpenShell doesn't just diff the YAML. It encodes the would-be state into SMT and asks reachability questions: *can this sandbox now reach a new host with credentials attached? call a new API method?* Risky deltas **wait for human review**. There's also a containment API: give it an operator boundary policy and a candidate, and it answers `Within` / not — with counterexamples when the answer is no.\n\nAnd the failure mode is the right one: the model has bounds (ASCII literals in network selectors, no embedded NUL bytes), and when a policy uses a shape it can't model, it returns `unsupported_policy_shape` — **\"I can't prove anything about this\"** — instead of a green light. The crate's own guidance: treat unknown values as fail-closed. Whoever wrote that sentence has been burned before, in the good way.\n\nIf you've followed the formal-verification world this week, the timing lands: Anthropic published the same evening that [LLMs are making formal verification feasible at much larger scale](https://www.anthropic.com/research/formal-verification). Put the two together and a pattern emerges for the agent era — **LLMs propose, solvers dispose**: the model writes the policy, the prover holds the gate, the human signs the deltas.\n\nThree honest limits, because a runtime named \"safe, private\" invites oversharing:\n\n```\ncurl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh\nopenshell sandbox create --name demo\n# then: docs.nvidia.com/openshell → \"Run Your First Agent\" (OpenCode + free OpenRouter model)\n```\n\nAnd for the prover, the crate README carries a containment example you can build from source: a boundary policy, a candidate, `check_within_boundary`, and a `CheckResult::Within` or a counterexample. Ten minutes with the policy schema teaches you more about agent confinement than a month of threads.\n\nRepo: [github.com/NVIDIA/OpenShell](https://github.com/NVIDIA/OpenShell) · Docs: [docs.nvidia.com/openshell](https://docs.nvidia.com/openshell/latest/index.html) · Apache 2.0, SDKs in Python/TypeScript/Go/Rust, skills for your coding agent (`npx skills add NVIDIA/OpenShell`).\n\n**TL;DR** — the agent-security stack is assembling in layers this month: kernel sandboxes for confinement, gateway-held credentials for custody, SMT provers for policy review, and (from the other camp) journals and attestations for evidence. Your agent still can't be trusted. But it can finally be *contained, funded, and proven* — which is what \"trusted\" was supposed to mean all along.", "url": "https://wpnews.pro/news/agents-should-never-hold-your-api-keys-nvidia-just-open-sourced-the-runtime-that", "canonical_source": "https://dev.to/slabb/agents-should-never-hold-your-api-keys-nvidia-just-open-sourced-the-runtime-that-enforces-it-3jm4", "published_at": "2026-10-23 11:05:26+00:00", "updated_at": "2026-10-23 11:13:27.525143+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools", "ai-infrastructure"], "entities": ["NVIDIA", "OpenShell", "Z3", "PyPI", "OpenRouter", "OpenCode", "Anthropic", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/agents-should-never-hold-your-api-keys-nvidia-just-open-sourced-the-runtime-that", "markdown": "https://wpnews.pro/news/agents-should-never-hold-your-api-keys-nvidia-just-open-sourced-the-runtime-that.md", "text": "https://wpnews.pro/news/agents-should-never-hold-your-api-keys-nvidia-just-open-sourced-the-runtime-that.txt", "jsonld": "https://wpnews.pro/news/agents-should-never-hold-your-api-keys-nvidia-just-open-sourced-the-runtime-that.jsonld"}}