Nvidia open-sources OpenShell, a secure runtime for autonomous AI agents

Nvidia has open-sourced OpenShell, a runtime for autonomous AI agents that need access to the shell, files and the network. The project is meant to address the biggest fear around agentic systems: how to give a model tools without handing it full control over the machine and corporate data.

Why it matters

A typical chatbot replies with text and has almost no attack surface. An autonomous agent is a completely different class of system: it keeps context between sessions, runs commands, writes code, installs packages, calls internal APIs and can work for hours without a human involved. In that setting, any prompt injection becomes more than a bad answer. It becomes a risk of leaked keys, read private files or unwanted actions inside the infrastructure.

This is the gap Nvidia is trying to close with OpenShell. The company released the project under the Apache 2.0 license, presented it in the context of GTC 2026 and built it into its stack for agentic systems. The idea is simple: security should come not only from prompts and the model's internal restrictions, but from a separate execution layer that sits between the agent and the operating system and does not depend on how carefully the agent itself behaves.

How OpenShell works

OpenShell acts as an external control perimeter. The agent inside it can use familiar tools, but every real action passes through separate control mechanisms. Nvidia describes this as moving the security policy outside the model itself: even if the agent is compromised or makes a mistake, it should not be able to bypass the infrastructure restrictions. This approach makes OpenShell agent-agnostic: you can wrap OpenClaw, Claude Code, Codex and other systems inside it without rewriting their logic for a new SDK.

• An isolated sandbox restricts access to the file system and does not let the agent freely modify the host machine.
• A policy engine sets fine-grained rules for binaries, network addresses, HTTP methods and access paths.
• A privacy router decides where to send inference: to a local model or an external API, if policy allows it.
• An audit log records why an action was allowed, blocked or redirected.

The foundation is declarative YAML policies. Static restrictions on the file system and processes are set when the sandbox is created, while network and inference policies can be updated on the fly without a restart. In its documentation, Nvidia specifically stresses that OpenShell uses kernel-level isolation, including Landlock for file system paths and seccomp to block dangerous system calls. This also leaves an explainable trail: the team sees not only the fact of a block but the specific reason for the decision.

What developers get

The practical advantage is that OpenShell does not require rewriting existing agents. A developer can start a sandbox with a CLI command, connect to it through a terminal, then open the needed access selectively through policy. There is also a remote mode: the sandbox can run not only locally but on a remote machine or GPU cluster, and be managed from an ordinary terminal. That makes the project suitable for local development, CI/CD and heavier production scenarios.

Another important point is secrets handling. OpenShell does not store keys in the sandbox file system; it injects them as environment variables at launch. In parallel, the privacy router keeps sensitive context in the local perimeter and sends requests to external models only under company rules. In effect, this is an attempt to turn the security of agentic systems from a set of ad hoc restrictions into a reproducible infrastructure practice.

"Sessions are isolated, resources are controlled, and permissions are checked before any action," is how

Nvidia describes OpenShell's core logic.

What it means

For the market, this is an important signal: the next round of competition in AI agents will be fought not only on model quality but on the quality of the execution environment. If OpenShell catches on, companies will be able to run more independent agents without the usual trade-off between usefulness and risk. For business, it opens the way to longer and costlier automation scenarios inside corporate perimeters, which were previously held back by security and control concerns.