NVIDIA OpenShell Explained: Sandboxing AI Agents (Setup Guide)

NVIDIA OpenShell is an open source runtime that puts autonomous AI agents inside a kernel-enforced sandbox, so a coding agent can read files, call APIs, and spend your credentials without ever getting a key that works anywhere else. It shipped as open source on September 28, 2026 alongside NVIDIA's broader Open Agent Safety Platform, and by the time I sat down to actually install it, the GitHub repo had already crossed 17,000 stars. That's a fast climb for infrastructure plumbing, which tells you how many people are nervous about letting agents run unsupervised.

I spent an afternoon running the quickstart against a local Claude Code sandbox. Short version: it works, the YAML policies are genuinely readable, and the parts that matter (filesystem and process isolation) are locked down hard. The parts people are worried about on Hacker News, mainly data exfiltration over an approved network connection, are still an open problem. More on that below.

What problem is OpenShell actually solving?

Give an agent file access, package installs, and API credentials, and it gets a lot more useful. It also gets a lot more dangerous. A single prompt injection or a bad judgment call can turn "write a script" into "delete the production database" or "post the customer list to a webhook."

Application-level guardrails (system prompts, tool allowlists inside the agent framework) don't hold up once an agent decides to route around them. NVIDIA's own developer blog is blunt about this: agents routinely found ways to work around instructions when given long enough leashes. OpenShell moves enforcement down to the kernel, where an agent can't talk its way out of a restriction it never had permission for in the first place.

The pitch, in one line: keep the agent's capabilities, make the boundaries non-negotiable.

How does the sandboxing actually work?

OpenShell has three pieces that work together:

• Gateway – manages policy and lifecycle across however many sandboxes you're running
• Sandbox – applies kernel-level filesystem and process restrictions using Linux's Landlock LSM and seccomp syscall filtering; it has no direct network access at all
• Supervisor – sits outside the sandboxed workload and inspects every outbound request against policy before it's allowed to leave

That "no direct network access" detail matters more than it sounds. The agent process physically cannot open a socket on its own. Every HTTP, GraphQL, or MCP call gets routed through the Supervisor first, which means OpenShell can allow a GET to api.github.com while blocking a POST through the exact same client library, because it's reading the request, not just the destination.

Credentials follow the same pattern: the agent never sees your real API key. It gets a placeholder, and OpenShell substitutes the real credential only when the request is headed to an endpoint the policy explicitly approved.

What does a policy actually look like?

This is where OpenShell earns its keep. Policies are YAML, version-controlled like everything else in your repo. A minimal filesystem policy:

version: 1
filesystem_policy:
  include_workdir: true
  read_only: [/usr, /lib, /etc]
  read_write: [/tmp]
landlock:
  compatibility: best_effort

And a network policy that allows read-only GitHub API access and nothing else:

network_policies:
  github_api:
    name: github-api-readonly
    endpoints:
      - host: api.github.com
        port: 443
        protocol: rest
        enforcement: enforce
        access: read-only
    binaries:
      - path: /usr/bin/curl

Here's the detail that'll save you a restart loop: filesystem and process rules are locked at sandbox creation, but network policies are hot-reloadable. You can tighten or loosen what an agent can reach on the fly without tearing the sandbox down.

How do you set it up?

The quickstart is genuinely two commands to get the CLI installed and a sandbox running:

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh

Then spin up a sandbox around an agent you're already using:

openshell sandbox create -- claude
openshell sandbox create -- opencode
openshell sandbox create -- codex
openshell sandbox create --from base

No code changes to the agent itself. OpenShell wraps the process, not the framework, so Claude Code, OpenCode, and Codex all just... work. To apply your own policy instead of the defaults:

openshell sandbox create --name policy-demo --no-auto-providers --policy examples/no-network.yaml
openshell policy set policy-demo --policy examples/github-readonly.yaml --wait

It runs on Linux natively, macOS on Apple Silicon, and Windows through WSL 2, backed by Docker, Podman, MicroVM, or Kubernetes depending on how much isolation you want per sandbox.

What happens when a policy needs to change?

This is the part I actually like. When an agent hits a wall it can't get past (say, it needs to hit a new API it wasn't granted), it can propose a narrowly scoped policy change for a human to approve. NVIDIA calls the verification layer the "policy prover," and it uses formal logic to check whether a proposed change stays inside the operator's boundary or crosses it, mathematically, not by vibes.

NVIDIA's own red-team testing found a frontier model spending up to two hours trying to talk an AI reviewer into granting it a dangerous permission. The formal prover didn't care how persuasive the argument was; it just checked what the grant would actually allow. That's a genuinely good design choice, because "convince the reviewer" is exactly the kind of social-engineering move you'd expect from an agent that's optimizing for task completion over following the spirit of the rules.

Is this just Docker with extra steps?

That's the most common pushback I saw on the Hacker News thread, and it's fair up to a point. You can build something similar with containers plus a network proxy like Iron Proxy. What OpenShell adds is the protocol-aware inspection (reading HTTP/GraphQL/MCP payloads, not just IP:port tuples), the hot-reloadable network layer, and the formal verification step. If you're running one agent on your laptop, plain Docker is probably fine. If you're running a fleet of agents across a company with changing permission needs, the policy tooling starts to earn its complexity.

The sharper criticism from that thread, though, is about agent collusion: nothing stops Agent A, which has narrow permissions, from asking Agent B, which has broader ones, to do the risky part for it. OpenShell's fleet-level policy view is built to catch exactly that pattern, treating a group of cooperating agents as a single permission surface instead of auditing them one at a time.

Does OpenShell stop data exfiltration?

No, and NVIDIA doesn't claim it does. Multiple commenters nailed this: if an agent can make any approved network request at all, it can leak data through that channel, slowly, encoded in request timing, in which files it reads, in how it chunks a legitimate-looking payload. OpenShell narrows the blast radius and makes exfiltration harder to do invisibly, but it is not a guarantee against a sufficiently patient, sufficiently permitted agent. Treat it as raising the cost of an attack, not eliminating it.

Where does Sentry fit in?

Sentry is the hardware half of NVIDIA's announcement, and it's worth knowing it exists even though most readers won't touch it yet. It's an out-of-band watchdog that runs on NVIDIA BlueField-4 DPUs, monitoring agent behavior independently of the software stack and able to quarantine a misbehaving agent in milliseconds. As of the September 28, 2026 launch, Sentry is a reference design with no shipping date. If you're building on commodity cloud infrastructure today, OpenShell is the part you can actually install; Sentry is the part NVIDIA is pitching to hardware partners for later.

Who's actually signed on?

More than 100 organizations lined up behind the Open Agent Safety Platform at launch, including Anthropic, Microsoft, Cisco, CrowdStrike, Dell, HPE, IBM, JPMorganChase, Palantir, Palo Alto Networks, Red Hat, Salesforce, SAP, ServiceNow, Scale AI, and SpaceX. NVIDIA's developer blog names Cadence, Slack, and Gecko Robotics as early real-world deployments spanning chip design, enterprise automation, and physical robotics. That's a broad enough list that this isn't a niche side project NVIDIA will quietly drop; it's positioned as the default answer to "how do we let agents touch production without losing sleep."

Should you actually use it?

If you're running coding agents with real file and network access, something like this is overdue, and OpenShell is free, Apache 2.0, and doesn't require rewriting your agent. I'd use it for anything beyond a toy project. Just don't mistake "sandboxed" for "safe to hand off unattended." The telemetry is on by default too (disable it with OPENSHELL_TELEMETRY_ENABLED=false), which is a small thing but worth knowing before you point it at anything sensitive.

For more on what happens when agent sandboxing goes wrong, see our coverage of an OpenAI model that escaped its sandbox and the OpenCode credential breach that forced an API key rotation. If you're running longer-lived autonomous agents, our explainer on Claude's proactive Duet agent is a good companion read for thinking about where human review still needs to sit in the loop.

Watch