Open, secure runtime for AI agents. It governs agent execution, access, and where inference goes.
The Secure Runtime for Autonomous Agents
Give agents the access they need to execute on the tasks you send them. NVIDIA OpenShell combines sandboxed execution, controlled resource access, credential protection, and formal policy verification, with enforcement outside the agent workload.
Manage agent behavior outside of its environment. OpenShell governs how agents interact with enterprise systems, data, and external services.
Agent-native infrastructure: OpenShell separates agent logic from the interfaces that connect it to its environment and to external systems. Execution is instrumented, and every action passes through policy enforcement.
Deployment flexibility: Run open or closed models with your choice of agent and harness across supported local, cloud, hybrid, on-premises, and air-gapped environments.
Deterministic governance: Deny access by default and grant permissions scoped to the declared task. OpenShell enforces policy outside the agent process, where enforcement cannot be influenced by model output.
OpenShell is the secure runtime in the NVIDIA Open Agent Safety Platform , an open reference system design for full-stack agent control that combines OpenShell and NVIDIA Sentry with NVIDIA BlueField-4 in-silicon security enforcement.
The OpenShell Architecture
OpenShell combines individual sandboxes, runtime supervision, centralized management, and formal policy verification to govern agent execution.
Isolate the workload and define its boundaries
Each sandbox runs an agent workload and has kernel-level controls over the file systems and networks the agent accesses. Those controls remain in place when the agent runs generated code or launches child processes. Network access passes through the supervisor for policy enforcement.
Enforce access policies outside the agent workload.
Each sandbox has a supervisor that checks outbound requests against policy. For configured HTTP, GraphQL, and Model Context Protocol (MCP) traffic, it can allow a read while blocking a write through the same API. The supervisor also keeps real service credentials outside the workload, substituting them only after network access and credential authorization checks pass.
Manage sandbox lifecycles and policies across your fleet.
The OpenShell Gateway manages the lifecycles and policies of many sandboxes. Govern individual workloads and groups, with separate workspaces, permissions, and service access for teams sharing infrastructure.
Verify the permissions a policy grants.
Use formal logic to check whether modeled permissions stay within operator-defined boundaries, including access contributed by service providers. The policy prover can establish that those permissions remain within a boundary or identify a concrete action that exceeds it, giving human and AI reviewers evidence to assess proposed policy changes.
OpenShell Documentation
Run OpenShell on DGX Spark
Run OpenShell on DGX Station
OpenShell Research and Developer Notes
Explore the NVIDIA Agent Safety Platform
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
