AI coding agents have become everyday teammates. On a developer’s machine, an interactive coding agent can read a repository, write code, run the build and the tests, and push the change, often without stopping to ask. That capability and speed is the point. It is also the risk: an agent acts with the full access rights of the developer who started it.
Those access rights can expose credentials as well as unrelated files, projects, and internal services if the agent makes an unsafe tool call. The agent can also write and run code that makes file and network requests beyond the agent’s visible tool interactions. A sandbox provides an enforceable runtime boundary, limiting the agent and its code to the resources the task requires.
NVIDIA recently introduced the NVIDIA Openshell Reference Architecture, built on a core principle: every agent should run in a zero-trust environment out of the box. OpenShell is also part of NVIDIA’s broader Open Agent Safety Platform. Cisco and NVIDIA are collaborating to build agentic trust. DefenseClaw, Cisco’s security layer for AI agents, connects OpenShell’s sandbox controls with identity-aware policy, AI Defense guardrails, and agent observability.
How identity, policy and the sandbox fit together: the user’s directory group picks a DefenseClaw policy profile, the profile shapes the OpenShell sandbox and its egress policy, and the guardrail hooks are relayed to the DefenseClaw gateway.
What NVIDIA OpenShell brings #
NVIDIA OpenShell is the secure runtime that governs how agents execute, which resources and data they can reach, and where inference is routed. Each agent runs in a sandbox. The administrators define which files, network and provider endpoints, tools, processes and credentials it may reach. Per-agent network egress policy acts as the micro-segmentation layer, while separate filesystem and process controls provide additional sandbox boundaries. OpenShell checks these limits before the agent starts and enforces them while it works.
The agent’s workload has no direct network access: a trusted supervisor relays every connection and denies anything the policy doesn’t allow. Provider credentials are supplied only for authorized requests; inside the sandbox, the agent sees placeholders.
OpenShell can run on developer workstations or be deployed in remote environments, including cloud, hybrid, on-premises, edge, and air-gapped settings. On Linux, the sandbox is a Container or a MicroVM. On Apple-silicon Macs, it is a MicroVM with its own kernel.
OpenShell’s runtime and policy language are open by design, so other vendors can plug in. DefenseClaw is built to do exactly that.
What DefenseClaw adds #
OpenShell provides the boundary. DefenseClaw provides the judgment, the policy and the record around it.
- Guardrails and observability inside the sandbox. Every prompt, tool call and tool result is checked and observed by DefenseClaw’s rules and by Cisco AI Defense.
- Control over where the agent can go. DefenseClaw decides each web destination by host name, without decrypting the traffic. Sites an organization always blocks stay blocked for everyone. Everything else is allowed, asked about or refused, depending on the policy.
- Changes you can review. At the end of a session, the developer sees what the agent changed and can keep it, undo it or pull it back.
- One audit trail. Every block, approval and decision is recorded along with the agent, the sandbox and the policy behind it, and can be sent to Splunk or any OpenTelemetry backend.
Cisco AI Defense is the policy and inspection endpoint: DefenseClaw sends it prompts, tool calls and responses and gets back a verdict based on rules the organization owns. Agent traffic never flows through it.
Securing Managed Endpoints #
Enterprise administrators can configure user or group-based policy to determine which coding agents can run on their managed endpoints, and which ones can run only in a sandbox. Policy profiles determine the guardrails applied as well as the sandbox configuration: which destinations are reachable, and which credentials and MCP servers come into the sandbox.
DefenseClaw gets identity from the operating system sign-in and uses that for user and group-based policy enforcement. When policy dictates that an agent runs only inside a sandbox, DefenseClaw refuses any agent invoked directly on the host and shows the exact command needed to start it inside a sandbox. When something is blocked or denied by policy, a clear message is shown that ties back to the policy rule as well as the path to request access.
Sandboxes started outside DefenseClaw as well as any unauthorized network rules added are stopped or removed and recorded. Admins can view each policy action taken, tied to the sandbox, the agent and the user.
AI Defense Endpoint is Cisco’s enterprise offering built on DefenseClaw. It extends Cisco AI Defense to the managed endpoints where developers run their coding agents.
Building agent trust together #
Trust in AI agents is an engineering problem, and no single vendor solves it alone. NVIDIA OpenShell gives every agent a secure runtime boundary. DefenseClaw makes that boundary part of how an organization already works: its identities, its policies and its security operations.
Try it today: Install DefenseClaw, run your coding agent in a sandbox: cd ~/code/myapp
defenseclaw sandbox run claude
Find more information on GitHub: https://github.com/cisco-ai-defense/defenseclaw