NVIDIA opens OpenShell, a kernel-level sandbox runtime for AI agents

A production AI agent needs to read files, install packages, call APIs and use credentials to be useful, which is the same list of things that lets a bad prompt or a hijacked tool reply steal source code or exfiltrate secrets. NVIDIA's answer, open sourced this week under Apache-2.0 as OpenShell, is to decide what each agent can do in a declarative policy that the Linux kernel enforces at every syscall. The repo was the top AI item on Hacker News in its slot, with 277 points, and it sits at position 24 on Trendshift's daily list with 17,755 stars.

OpenShell is a runtime for fleets of autonomous agents, not a framework for writing them. Each agent runs in its own sandbox with four protection layers: Landlock blocks filesystem reads and writes outside allowed paths, an allow list filters every outbound network connection, seccomp and an unprivileged process identity block privilege escalation and dangerous syscalls, and real credentials are resolved only into requests bound for endpoints the policy named up front.

The policy and the prover

Two things sit above the kernel enforcement. The policy itself is declarative YAML, listing allowed filesystem paths, hosts, syscalls and credential providers for each sandbox. Every policy change goes through what the project calls a formal advisor and prover: before a change is approved, OpenShell checks what new access it would grant (reaching a new host with credentials, calling a new API method) and holds those changes for human review. Filesystem and process rules are locked at sandbox creation; network rules are hot-reloadable at runtime.

The threat model the docs name is the one every agent operator has already met. Data exfiltration, blocked by network policy. Credential theft, blocked by filesystem restrictions. Unauthorized API usage, blocked by provider profiles.

What it runs and how

The quickstart installs a CLI and a local gateway with a minimal Ubuntu sandbox image and no agent inside. OpenShell publishes SDKs in Python, TypeScript, Go and Rust, a Helm chart for Kubernetes (the cluster CNI has to enforce NetworkPolicy), and a Brev Launchable for cloud GPUs. Supported hosts are Linux, Apple silicon macOS and Windows with WSL 2 (listed as experimental).

Credentials are the detail worth watching. The project calls them providers, and the opaque placeholder is only resolved into the request when OpenShell is about to send it, and only when the destination is on the policy's list. The agent itself never sees the real token, so a prompt injection cannot leak a key the sandbox is holding.

For a team running agents in production

The useful read is where OpenShell draws the trust boundary. Most agent frameworks today put the final rules on what the agent may do inside the agent itself: in the system prompt, the tool list, or a wrapper around tool calls. All three live in the same process as the model, so a successful prompt injection, a bad tool reply or a model update can push the agent across them without any observable fault. OpenShell moves that boundary to the kernel, which stays authoritative whether the model complies or not. The cost is a declarative policy that has to list every path, host and syscall up front, plus the prover reviewing every change. The project is at version 0.1.5 under Apache-2.0, so an operator reading the source knows the controls depend on Linux Landlock and seccomp rather than a vendor's own kernel work.

Source

NVIDIA/OpenShell on GitHub and the overview in the project documentation. The Hacker News discussion was at 277 points when checked.