Every agent framework in 2026 does the same thing: it hands the agent its credentials and trusts it to behave. NVIDIA just open-sourced the alternative. OpenShell is a kernel-level sandbox runtime that runs AI agents in deny-by-default environments — where policy is enforced by the Linux kernel, not by instructions you gave the model — and where the agent never sees the API keys it uses. Released with a Red Hat partnership on October 21, it has crossed 17,600 GitHub stars and landed in production at Salesforce, SAP, and SpaceXAI.
The Problem Every Agent Framework Ignores #
When you deploy an agent today, you typically set the API keys as environment variables, give the agent the file system access it needs, and rely on the model’s training to keep it in bounds. That works fine until the agent is compromised — through prompt injection, a poisoned tool response, or a supply chain attack — at which point the attacker inherits everything the agent had. GitGuardian found 24 million leaked non-human credentials on GitHub in 2025, with 70% still valid years after exposure. In a survey from Kiteworks, 65% of organizations reported an AI agent security incident in the past year. Ninety percent of deployed agents are over-permissioned.
The architecture is the problem. Application-layer controls — system prompts, permission checks in agent code — can be bypassed by definition. If the agent can write and execute code, it can disable its own guardrails. Infrastructure-layer enforcement cannot be bypassed that way. OpenShell puts security in the second category.
How OpenShell Sandboxes an Agent #
OpenShell has three components: a gateway (the control plane), a supervisor, and per-agent sandboxes. Each sandbox wraps an agent in a minimal Ubuntu environment and enforces a declarative YAML policy using three Linux kernel mechanisms: Linux Landlock for filesystem isolation, seccomp BPF to filter which system calls the process can make, and network namespaces to isolate the agent’s network context. All three operate below the application layer — the sandboxed process cannot modify them from inside.
Policy is split into static and dynamic sections. Filesystem and process constraints lock at sandbox creation. Network policies and inference provider routes are hot-reloadable on a running sandbox — you can update what external endpoints an agent can reach without tearing it down. Every policy change goes through a Z3 SMT prover before a human approves it, catching any new access a change would silently grant.
A minimal policy looks like this:
version: 1
filesystem_policy:
include_workdir: true
read_only: [/usr, /lib, /etc]
read_write: [/tmp]
landlock:
compatibility: best_effort
That’s it. The agent gets its working directory and /tmp. Everything else is denied unless you explicitly allow it.
The Credential Architecture #
The most important feature of OpenShell is not the kernel isolation — it’s how credentials work. Raw API keys live on the host, held by the OpenShell gateway. The agent makes inference requests to the gateway, which authenticates with the upstream provider on the agent’s behalf. The agent never sees the key. A compromised agent cannot exfiltrate credentials it never had access to. This is the same principle behind hardware security modules and secrets managers, applied to AI inference routing.
This design also gives you a complete audit log of every inference call the agent makes — including exact tokens sent and received — at the gateway level, without modifying the agent code.
Getting Started #
OpenShell installs in one command on Linux, macOS Apple Silicon, and Windows via WSL 2:
curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
openshell sandbox create --name demo
If you use a coding agent like Cursor or Claude Code, you can teach it to manage OpenShell directly:
npx skills add NVIDIA/OpenShell
That installs the NVIDIA-maintained skills package, which gives your coding agent knowledge of the OpenShell CLI, how to write sandbox policies, and how to debug gateway and inference routing issues. The runtime is Apache 2.0 on GitHub with no production use restrictions.
Sentry: When Containers Are Not Enough #
For teams running large agent fleets, NVIDIA pairs OpenShell with Sentry — a reference design running on BlueField-4 DPUs, a physically separate processor embedded in the network card. Sentry monitors agent behavior from outside the host OS and can quarantine a boundary-crossing agent in milliseconds without host software cooperation. Think of it as the safety island in a self-driving car: a system whose only job is to make the whole system fail safely.
Sentry is enterprise infrastructure. A solo developer does not need it. But it matters for the broader picture: OpenShell is designed to scale from a single developer’s laptop to a production fleet with hardware-level enforcement.
Already in Production #
OpenShell launched with over 100 partners. Three deployments worth noting: SpaceXAI is running Cursor coding agents and Grok models through OpenShell. Salesforce integrated it with Slack so teams can approve or reject agent permission requests from inside their workflow. SAP is embedding it directly in Joule Studio, with engineers contributing to the open-source codebase.
Red Hat joined the effort on October 21, integrating OpenShell into Red Hat AI Factory and committing to support it on NVIDIA Vera Rubin hardware from day one. The broader partner list — Anthropic, Microsoft, Cisco, CrowdStrike, Palantir — signals this is production infrastructure, not a research project.
Self-Enforcement Is Not Enforcement #
The fundamental mistake most agent frameworks make is treating security as something the agent opts into. System prompts, in-code permission checks, model-level refusals — these are application-layer controls that assume the model will cooperate. Every other software security discipline learned decades ago that you cannot trust a process to enforce its own boundaries. OpenShell applies that lesson to AI agents.
Whether you are running a one-agent prototype or a fleet of autonomous systems, the model is the same: define what the agent is allowed to do, enforce it at the infrastructure layer, and hold credentials outside the sandbox. OpenShell makes that practical in a single install. There is no good reason not to use it.