Agents should never hold your API keys. NVIDIA just open-sourced the runtime that enforces it
NVIDIA open-sourced OpenShell, an Apache 2.0 runtime that runs agent fleets in kernel-level sandboxes so agents never hold real API keys or cloud credentials, enforcing filesystem, network and process…