NVIDIA OpenShell Introduces Runtime Controls for AI Agent Security
Open-source runtime enforces access policies without agent code modifications
1Runtime security for AI agents
NVIDIA OpenShell 0.1.0 provides an open-source runtime that enforces system and data access controls for AI agents without requiring code changes. The solution combines sandboxed execution, controlled service access, credential management, and formal policy analysis. Major organizations like Cadence, Slack, and Gecko Robotics are already adopting it for chip design, enterprise automation, and physical robotics governance.
2Core security components
OpenShell's architecture consists of three main components: Gateway for managing agent fleets, Supervisor for inspecting outbound requests against policies, and Sandbox for applying kernel-level filesystem and process controls. The system can restrict API operations while protecting credentials outside the agent workload. It supports popular frameworks including Codex, Claude Code, Pi, and Hermes across various applications.
3Policy enforcement mechanism
OpenShell uses YAML-based policies compiled to OPA/Rego for runtime evaluation. The system can distinguish between read and write operations, allowing queries while blocking modifications through the same API. These controls persist when agents start shells, run generated code, or delegate tasks. All policy decisions are recorded in an Open Cybersecurity Schema Framework audit trail.
4Credential protection system
OpenShell maintains real credentials outside agent workloads, substituting placeholders during execution. Authorization for one service doesn't make credentials available to others. Even with valid credentials, inspected API policies can block unauthorized operations. The receiving service still enforces its own permissions, while OpenShell adds an additional layer of control over credential usage.
5Dynamic policy adjustments
Agents can request additional access when encountering blocked operations. Policy advisor enables agents to propose narrowly scoped changes, which remain pending for human review by default. Approved rules load into running sandboxes without requiring restarts. Filesystem and process restrictions, however, require new sandboxes for changes.
6Formal verification of permissions
OpenShell's policy prover uses formal logic to verify permissions stay within defined boundaries. It can identify concrete actions that would cross these limits, providing evidence even when agents attempt to manipulate reviewers. In tests, frontier agents spent hours trying to persuade AI reviewers to grant protected repository access, but OpenShell prevented unauthorized writes.
7Enterprise deployment options
Teams can start with local sandboxes during development, then deploy to shared infrastructure using workspaces. Compute drivers support Docker, Podman, MicroVM, and Kubernetes environments. Trusted middleware outside sandboxes can integrate identity services and add application-specific checks to the request path.
8Adoption across industries
OpenShell is gaining traction in diverse applications including chip design, enterprise automation, accelerated computing, and physical AI. As part of NVIDIA's Open Agent Safety Platform, it provides runtime layer protection that complements application and infrastructure security measures.
9Community engagement
NVIDIA encourages developer participation through GitHub contributions and the #openshell-dev channel on CNCF Slack. The open-source approach allows ecosystem partners to influence product development. Documentation includes quickstart guides, migration notes, and ongoing research updates in OpenShell dev notes.