OpenShell
A technical team applying formal methods to the control of AI agents, exploring the use of mathematical logic to constrain agent behavioral boundaries and improve the reliability and safety of AI systems.
Core Facts
OpenShell assigns an isolated execution sandbox to each agent session or task, restricting the scope of the file system, network egress and local processes it can access.
OpenShell is positioned as a programmable control layer between agents and their operating environment, inspecting and constraining every action taken by an agent
OpenShell is positioned to serve local and open-source agents.
Timeline (last 90 days)
OpenShell supports creating a sandbox with a single command and can run locally or on Kubernetes.
OpenShell requires every network connection to pass a policy check before leaving the sandbox.
OpenShell provides SDKs for Python, TypeScript, Go, and Rust for connecting to the gateway.
OpenShell is currently in the Alpha stage and already has over a hundred partners, but OpenAI is not on the partner list.
OpenShell includes a policy prover that uses formal logic to prove operational boundaries, with conclusions that do not depend on the agent's explanations.
OpenShell uses the operating system kernel to confine agents in a sandbox, restricting the files they can access and the processes they can start, and completely blocking their network, with outbound requests checked against policy by a Supervisor outside the sandbox.
On September 28, NVIDIA open-sourced an agent security platform, OpenShell.
There is no public data yet on the OpenShell sandbox's performance overhead and policy maintenance costs.
NVIDIA open-sourcing OpenShell is a signal of extending from compute supplier to agent infrastructure, aiming to seize the entry point of agent security boundaries.
OpenShell enables anonymous telemetry by default, but users can turn it off.
40 more timeline events
All Facts (20)
OpenShell assigns an isolated execution sandbox to each agent session or task, restricting the scope of the file system, network egress and local processes it can access.
80%VerifiedOpenShell is positioned as a programmable control layer between agents and their operating environment, inspecting and constraining every action taken by an agent
75%VerifiedOpenShell is positioned to serve local and open-source agents.
65%VerifiedNVIDIA has released an open agentic safety platform comprising open-source software OpenShell and hardware Sentry that runs on data processing chips.
75%Partially VerifiedOpenShell's credential handling mechanism ensures the agent never sees the real keys; only when a request is sent to a user-approved endpoint does OpenShell inject the key.
65%UnverifiedOpenShell uses formal verification to handle policy changes: when a policy is modified, it first uses mathematical methods to verify which new access permissions the change would grant, and high-risk changes are always blocked pending human review, so the agent cannot escalate its own permissions.
60%UnverifiedNVIDIA open-sourced OpenShell on GitHub, a runtime security sandbox designed specifically for autonomous AI agents.
60%UnverifiedOpenShell requires every network connection to pass a policy check before leaving the sandbox.
50%UnverifiedOpenShell supports creating a sandbox with a single command and can run locally or on Kubernetes.
50%UnverifiedOpenShell provides SDKs for Python, TypeScript, Go, and Rust for connecting to the gateway.
50%UnverifiedOpenShell is currently in the Alpha stage and already has over a hundred partners, but OpenAI is not on the partner list.
50%UnverifiedOpenShell uses the operating system kernel to confine agents in a sandbox, restricting the files they can access and the processes they can start, and completely blocking their network, with outbound requests checked against policy by a Supervisor outside the sandbox.
50%UnverifiedThere is no public data yet on the OpenShell sandbox's performance overhead and policy maintenance costs.
50%UnverifiedOpenShell includes a policy prover that uses formal logic to prove operational boundaries, with conclusions that do not depend on the agent's explanations.
50%UnverifiedOpenShell is fully open source under the Apache 2.0 license.
50%UnverifiedOpenShell provides a full set of SDKs for Python, TypeScript, Go, and Rust, and can directly install Agent Skills for coding agents to invoke themselves.
50%UnverifiedNVIDIA open-sourcing OpenShell is a signal of extending from compute supplier to agent infrastructure, aiming to seize the entry point of agent security boundaries.
50%UnverifiedOpenShell's foundation is written in Rust, follows a zero-trust approach, uses full-chain mTLS encryption, and its isolation drivers cover multiple forms including Docker, Podman, Kubernetes, and virtual machines.
50%UnverifiedUsing OpenShell's VM driver on macOS may crash outright.
50%UnverifiedOpenShell's managed sandbox currently supports only Unix-family operating systems.
50%