NVIDIAOpenShell — OpenShell is the safe, private runtime for autonomous AI agents

NVIDIA just open-sourced OpenShell, a runtime for fleets of autonomous AI agents where your agent never sees a real API key. Apache 2.0, version 0.1.x, published on GitHub this week.

For about two years the industry has shipped agents with one real security control: a paragraph of English at the top of the context window. Please don't push to main. Please don't delete the home directory. Meanwhile that agent runs as your user, with your dotfiles, your SSH keys and your cloud credentials sitting in environment variables. And it works — mostly. Mostly is a fantastic hit rate for autocomplete and a terrible one for a process with shell access.

OpenShell enforces in exactly two ways:
- KERNEL CONTROLS — each agent gets its own sandbox; kernel controls confine which files it can reach and which system calls it can make, and every outbound connection passes a policy check before it leaves.
- FORMAL VERIFICATION — edit a policy and the change is checked before it's applied, to determine what it would newly allow. Risky new access gets flagged and held for human review. The docs call the two pieces the advisor and the prover.

The interesting part is the credential design. Your agent believes it has an API key; the secret is actually added at the gateway, only on requests bound for endpoints your policy already approved — inference keys included. Send that request somewhere else and there's nothing to leak, because nothing was ever in the sandbox. A secret became a capability: the agent doesn't hold the key, it holds permission to use the door.

The architecture is gateway, supervisor, sandbox. Install runs on Linux, macOS on Apple Silicon, or Windows with WSL 2 (NVIDIA marks that experimental), plus Docker, Podman or host virtualization — then openshell sandbox create --name demo. The default image is minimal Ubuntu with no agent installed, an empty room you fill yourself. Four SDKs (Python, TypeScript, Go, Rust) talk to a gateway, and the Helm path carries one footnote worth the read: your CNI must enforce NetworkPolicy, or the network half of your enforcement is decoration.

⚠️ This is CONTAINMENT tooling: constraining software you choose to run on machines you own. No attack techniques, no bypasses — just what the runtime enforces and where it stops.

⏱️ Chapters:
00:00 NVIDIA Open-Sourced OpenShell
00:32 Two Years of Please Don't
00:59 "Mostly" Is the Problem
01:28 Kernel Enforcement Plus Change-Time Proof
01:52 Every File, Every Packet
02:18 What a Reference Monitor Is
03:06 Your Agent Never Holds Credentials
03:43 Inference Keys Count Too
04:02 Policy Changes Get Verified First
04:26 Testing Versus Verifying a Policy
05:02 Gateway, Supervisor, Sandbox
05:29 Installing OpenShell 0.1.x
05:54 An Empty Ubuntu Room
06:24 Cloud Trial and Kubernetes Helm
06:51 Four SDKs, One Version Rule
07:32 OpenShell Ships Agent Skills
07:57 Built Agent-First, By Agents
08:31 The Telemetry Exclusion List
09:11 Honest Limits at 0.1.x
09:58 What Changes If You Ship Agents
10:32 GPUs, Middleware and Fleets
10:55 The Human Gets a Better Interface
11:15 A Kernel Doesn't Have to Ask