A container is a room—not a permission system #
AI agents present a substantial new risk: developers routinely grant tools like Claude Code or Codex broad access to sensitive repositories, APIs, and credentials, then let them run unattended. This convenience often comes at the cost of security, as an agent’s utility is directly tied to its access to critical resources.
Ordinary containers, while effective at host isolation, cannot differentiate nuanced actions. A GitHub connection, for instance, permits both reading data and making destructive changes. The container sees only traffic to the same address, unable to discern whether an agent is merely browsing code or actively opening issues.
NVIDIA’s OpenShell, a new open-source sandbox, addresses this gap. Written in Rust and licensed under Apache 2.0, OpenShell controls what an agent can do with its access, not just if it can reach a resource. Crucially, it requires no NVIDIA GPU, running on standard hardware.
OpenShell's policy-first design enforces granular control over file access, system calls, and network connections. It operates with a default-deny posture, meaning agents can do nothing until explicitly permitted. This fine-grained enforcement is a significant leap beyond basic containerization.
The bouncer checks every way out #
OpenShell maps three core components: the Gateway acts as the interface and control plane; the Supervisor enforces policy and brokers credentials; and the Sandbox provides the constrained environment where the agent executes. The Sandbox’s only egress path routes through the Supervisor, ensuring all external interactions are mediated.
Default-deny behavior is central to OpenShell’s security model. Kernel-level filesystem and process restrictions block unauthorized paths and privilege escalation from the outset. Any network request from the agent must pass through the Supervisor, which scrutinizes it against predefined policies.
Consider a policy allowing the curl binary to make read-only requests to the GitHub API. The Supervisor permits this. However, if that same curl binary attempts an unapproved POST request to create an issue, the Supervisor denies it. These policies update live via openshell policy update without restarting the sandbox, and every denial is logged, providing a clear audit trail.
Critically, the agent never directly handles credentials. The Supervisor injects tokens only for approved requests, preventing exfiltration via prompt injection. Even DNS resolution occurs via the Supervisor, limiting the agent’s visibility and control. This design ensures that even if an agent is compromised, it has no keys to leak.
The clever part: your agent never holds the key #
OpenShell’s most ingenious feature is credential masking: the agent never directly holds sensitive API keys or tokens. Instead, the Supervisor retains these secrets, injecting them only into approved outbound requests that align with the established policy. This design significantly reduces the attack surface for prompt injection, as there are no credentials for the agent to leak.
Before any policy changes go live, OpenShell employs a Z3 solver to act as a formal verifier. This mathematical engine assesses proposed policy modifications, calculating the full scope of newly granted access. This proactive check helps expose risky rules, such as unintended wildcards or overly broad permissions, preventing them from ever being deployed.
While alternatives exist—Docker provides basic isolation, Anthropic’s sandbox runtime offers a lighter setup, and hosted solutions like E2B or Daytona provide managed execution—OpenShell carves out a niche. It emphasizes self-hosted, policy-driven agent control, running on top of container runtimes like Docker, Podman, or Kubernetes. For those interested in the underlying architecture and open-source contributions, the project is available at NVIDIA/OpenShell on GitHub. OpenShell represents a shift from simply asking "can the agent reach it?" to "what is the agent allowed to do with it?" NVIDIA's telemetry reports show that in two weeks this summer, OpenShell created over 550,000 sandboxes and denied 4.2 million agent actions, underscoring its active role in enforcing agent boundaries.
Enjoying this? Get one like it in your inbox each morning.
one email a day · unsubscribe in two clicks · no third-party tracking
Useful guardrails, not a security force field #
OpenShell offers useful guardrails, not a security force field. Its early stage is evident: despite prominent ecosystem interest from Cisco, CrowdStrike, Google Cloud, and Microsoft Security, the project version is only 0.1.5, labeled an "early preview." Telemetry is enabled by default, anonymously counting events, though an environment variable can disable it.
Mac users should note that OpenShell sandboxes are Linux-based, running within Docker Desktop’s virtual machine. This requires kernel features like Landlock and host networking enabled, which is often off by default. NVIDIA’s own doctor command might report green, but testing is advised.
NVIDIA’s internal telemetry reports staggering activity: over 550,000 sandbox creations and 4.2 million denied agent actions within a two-week period. These numbers highlight the scale of agent overreach OpenShell intercepts. However, NVIDIA also reported approximately 12% of sandbox creations failed during the same period; these are company telemetry figures, not an independent audit.
For simpler local coding with tools like Claude Code, a basic container or Anthropic Sandbox Runtime might suffice with less setup. But for agents handling real credentials or long-running, unsupervised tasks, OpenShell’s per-request rules and credential masking are invaluable. Careful policy design remains critical, as sandboxing mitigates risks but cannot eliminate all potential vulnerabilities.
Frequently Asked Questions #
What is NVIDIA OpenShell?
OpenShell is an open-source runtime for restricting AI agents’ file, process, and network access through policies enforced outside the agent.
Does OpenShell require an NVIDIA GPU?
No. The video demonstrates it running on a Mac; OpenShell is not dependent on NVIDIA GPU hardware.
How is OpenShell different from Docker?
Docker isolates a container, while OpenShell adds fine-grained controls, including rules for which process can access specific network endpoints and operations.
Does OpenShell prevent every AI agent security risk?
No. It limits what an agent can access, but it is not a complete security guarantee; configuration, isolation boundaries, and software maturity still matter.