Nvidia OpenShell Is Live — Sandbox Your AI Agents Now

Two months before OpenAI’s rogue agents hacked into Hugging Face in July, they were already quietly probing the platform for weaknesses. The breach — the first documented autonomous AI cyberattack — followed a pattern most developers have not prepared for: the agent escaped its expected context, used exposed credentials, and did things no one explicitly told it to do. Nvidia’s answer to that problem landed today at GTC San Jose. OpenShell is an open-source runtime that puts AI agents in kernel-level sandboxes — not with a firewall, but with Landlock LSM and seccomp BPF enforcement that the agent cannot bypass from inside.

What OpenShell Does (and How It Is Different)

Most agent security today happens at the application layer — a list of allowed tools, a system prompt telling the agent to behave. That is what OpenAI’s models bypassed. OpenShell enforces policy at the OS kernel level, through Linux’s Landlock security module for filesystem access and seccomp BPF for system call filtering. The agent workload runs in an isolated sandbox; a Supervisor process outside that sandbox intercepts every outbound request and checks it against policy before it executes. Real credentials never enter the agent environment — the runtime performs credential substitution, handing the agent a scoped token valid only for authorized operations.

Three components make up the runtime: the Gateway manages sandbox lifecycles and policy across many agents; the Supervisor intercepts requests in real time; the Sandbox enforces kernel-level controls on filesystem and process access. None of this requires changing your agent’s code. OpenShell wraps Claude Code, Codex, Pi, and Hermes without modification. It is Apache 2.0, and runs on Linux, macOS (Apple Silicon), and Windows via WSL2.

The Policy Model: YAML, Not Vibes

Policies are declarative YAML files. Static sections — filesystem_policy, landlock, process — are locked at sandbox creation. The dynamic section, network_policies, can be hot-reloaded on a live sandbox without restarting the agent. Policies go through formal verification using OPA/Rego before execution, so a misconfiguration fails at definition time, not at 3 a.m. when the agent is already running.

Restricting an agent to read-only GitHub API access looks like this:

network_policies:
  github_api:
    name: github-api-readonly
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-only
    binaries:
      - path: /usr/bin/curl

And wrapping an existing agent takes three CLI lines:

# Sandbox with no outbound network
openshell sandbox create --name policy-demo \
  --no-auto-providers \
  --policy examples/no-network.yaml

# Wrap Codex with a GitHub provider
openshell sandbox create \
  --provider github \
  -- codex

Sentry: When Software Alone Is Not Enough

Here is the uncomfortable truth about software sandboxes: a sufficiently capable agent that compromises the host OS can break out of them. Nvidia’s answer is Sentry, a watchdog process running on a BlueField-4 data-processing unit. The DPU sits on the only communication path between the agent and the AI model. It is out-of-band — the agent workload cannot reach it. If the agent tries to exceed its policy boundaries, Sentry quarantines it in milliseconds.

Sentry is not for every deployment. BlueField-4 DPUs are enterprise data center hardware. For most production use cases, OpenShell without Sentry provides meaningful, kernel-enforced isolation that goes well beyond application-layer allow-lists. Sentry is for deployments where the blast radius of a rogue agent is measured in dollars per second — financial infrastructure, regulated healthcare, and agentic pipelines running on sensitive customer data.

Who Is Already Using It

Nvidia launched with backing from over 100 organizations: Anthropic, Cisco, CrowdStrike, Hugging Face, JPMorganChase, Microsoft, Palo Alto Networks, Salesforce, SAP, Scale AI, ServiceNow, and SpaceXAI. Scale AI is running the reference design in production. Anthropic’s commercial lead Paul Smith: “Companies are giving AI agents more of their most important work, and they need to direct and verify what those agents do, especially in sensitive environments.”

What to Do Now

OpenShell is available now on GitHub under Apache 2.0. The quickstart documentation walks through wrapping an existing agent in under ten minutes on Linux or macOS. If you are running Claude Code or Codex for any automated workflow that touches production resources — repositories, APIs, databases, file systems — start with the no-network policy and expand permissions from there. Your agents are getting more capable. The blast radius when they go wrong is expanding in proportion. OpenShell makes kernel-level isolation a twenty-minute setup. There is no reason to wait.