Nvidia has released OpenShell 0.1.0, an open-source runtime designed to safely manage fleets of autonomous AI agents by controlling what they can access without giving them unrestricted permissions.
According to the GitHub repository, OpenShell addresses a core challenge in deploying AI agents: they are most useful when they can read files, install packages, call APIs, and use credentials, but doing so securely requires careful access control. The tool enforces policies through two mechanisms.
First, OpenShell uses kernel-level enforcement, with each agent running in an isolated sandbox. The kernel controls which files an agent can access and which system calls it can make. All network connections pass through a policy check before leaving the sandbox, and agents never see real credentials—OpenShell adds them only to requests bound for approved endpoints.
Second, before a policy change is approved, OpenShell uses formal verification to flag risky new access it would grant, such as reaching a new host with credentials or calling a new API method. These changes then wait for human review before being applied.
The 0.1.0 release introduces a stable release cadence, new isolation primitives, an expanded extension surface, and new APIs, according to the project documentation.
OpenShell requires Linux, macOS on Apple Silicon, or Windows with WSL 2 (marked as experimental), along with Docker, Podman, or host virtualization. The tool provides a CLI installer and supports deployment on Kubernetes using Helm. SDKs are available for Python, TypeScript, Go, and Rust, allowing applications to connect to an OpenShell gateway.
The project is built around agent-first workflows and uses the same agent-driven development practices it enables. OpenShell collects anonymous operational telemetry but does not gather sandbox names, file paths, prompts, credentials, or user content. This telemetry can be disabled via environment variables or compiled out entirely.
The software is licensed under Apache License 2.0 and is available on GitHub.
Key facts
- OpenShell 0.1.0 introduces kernel-level enforcement and formal verification for AI agent sandboxing
- Agents run in isolated sandboxes with restricted access to files, system calls, and network connections
- Formal verification flags risky policy changes before they are applied, requiring human review
- SDKs are available for Python, TypeScript, Go, and Rust
- The release includes a stable cadence, new isolation primitives, and expanded extension surface