NVIDIA has released OpenShell, an open-source runtime designed to safely manage fleets of autonomous AI agents by controlling what they can access without restricting their core capabilities.
According to the project documentation, OpenShell addresses a key challenge in deploying AI agents: agents are most useful when they can read files, install packages, call APIs, and use credentials, but granting these capabilities risks exposing sensitive data and systems. OpenShell solves this by letting developers declare what each agent can access through policies, which the runtime then enforces.
The system uses two enforcement mechanisms. First, it instruments the kernel to enforce policy on every file access, system call, and network connection at runtime. Each agent runs in an isolated sandbox where kernel controls confine which files it can access and which system calls it can make. Every network connection passes through a policy check before leaving the sandbox. Critically, agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints.
Second, OpenShell uses formal verification to check what policy changes would allow before they are applied. This means risky new access—such as reaching a new host with credentials or calling a new API method—gets flagged for human review before approval.
OpenShell 0.1.x, announced as a stable release, includes new isolation primitives, an expanded extension surface, and new APIs. The runtime requires Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman, or host virtualization.
The project includes SDKs for Python, TypeScript, Go, and Rust, allowing applications to connect to an OpenShell gateway without installing the CLI. NVIDIA also provides public OpenShell skills—sets of instructions that teach agents to drive the OpenShell CLI, write sandbox policies, and debug gateways.
OpenShell collects anonymous telemetry limited to operational categories and counts, but does not collect sandbox names, file paths, prompts, credentials, or user content. Users can disable telemetry by setting environment variables during installation.
The software is licensed under Apache License 2.0 and is developed agent-first, using the same agent-driven workflows it enables. NVIDIA notes that the software automatically retrieves external materials governed by separate terms and is provided without warranty.
Key facts
- OpenShell enforces agent access through kernel-level sandboxes and formal verification of policy changes
- Agents receive real credentials only for approved endpoints, not direct access to credential stores
- The system enforces policies on file access, system calls, and network connections at runtime
- OpenShell 0.1.x includes stable release cadence, new isolation primitives, and expanded APIs
- SDKs are available for Python, TypeScript, Go, and Rust