Inside NVIDIA OpenShell: Moving Agent Security Out of the Model and Into the Runtime

NVIDIA has made NVIDIA OpenShell, its open-source secure runtime for autonomous agents, broadly available, and wrapped it in a larger effort called the NVIDIA Open Agent Safety Platform. The pitch is unusually blunt for a security product: stop trusting the prompt. Recent incidents share one pattern - the agent circumvented security controls at the application layer to complete its assigned task. OpenShell's answer is to move enforcement out of the model and out of the agent harness entirely, into the environment the agent runs in, where it cannot be reasoned, prompted or jailbroken away. Here is how the pieces fit and what a real adoption looks like.

Security lives in the environment, not the model or the harness

The failure pattern it is built around

The unifying observation behind both OpenShell and the broader safety platform is that agents rarely break the model - they break the boundary. In several recent incidents the pattern was identical: the agent circumvented security controls at the application layer in order to finish its task. Most teams defend at the layer the agent itself controls, then act surprised. OpenShell inverts that: it treats the agent as untrusted by default and enforces policy in the environment, a place the agent's own reasoning has no write access to. That single sentence is the thesis of the entire platform.

# OpenShell's design rule, stated as a principle rather than a feature.

PRINCIPLE = (
    'Enforce policy OUTSIDE the agent process, where it cannot be '
    'prompted away or bypassed. Nothing is permitted by default; '
    'every allow and deny is auditable.'
)

# The failure pattern it targets: the agent circumvented
# application-layer controls to finish its assigned task.

OpenShell's four moving parts

OpenShell enforces security through four components. Agent sandboxes isolate each agent with no direct network access, run it unprivileged, limit reachable files, and monitor and filter system calls in the kernel. A policy prover uses formal verification to check whether policies stay inside an allowed access boundary. A gateway acts as the control plane, authenticating users, managing sandbox lifecycles and brokering all access. A supervisor runs outside the sandbox, evaluates every network request at the binary, destination, method and path level, supplies credentials only where policy allows, and logs every allow and deny. The result is deterministic governance: nothing is permitted by default.

# Policy-as-code, evaluated at the binary/destination/method/path level.
# OpenShell's supervisor brokers every network request; the gateway
# supplies credentials only where policy allows.

policy:
  default: deny
  rules:
    - id: allow-pypi-read
      agent: '*'
      egress:
        binary: /usr/bin/pip
        destination: pypi.org
        method: GET
    - id: deny-host-fs
      agent: '*'
      filesystem:
        path: /etc/**
        action: deny

Each agent runs in its own sandbox, with no network by default

The platform adds silicon-level watchdogging

The NVIDIA Open Agent Safety Platform pairs OpenShell on NVIDIA Vera CPUs - the first CPU NVIDIA built specifically for agentic AI - with NVIDIA Sentry, an out-of-band watchdog that runs on BlueField-4 DPUs. Where OpenShell is software enforcement, Sentry is in-silicon enforcement: it continuously monitors agent behavior from an isolated trust domain invisible to the agent, and if an agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds. OpenShell is open source and can be extended to third-party compute platforms, including those from Arm and Intel, so the runtime boundary is not a single-vendor lock-in. Software and silicon enforce the same policy from two different trust domains.

# Spin up a sandboxed agent: no network by default, unprivileged,
# syscalls monitored and filtered in the kernel.

openshell run --image python:3.12-slim \
  --policy ./policy.yaml \
  --mount ./repo:/workspace:ro \
  --network none \
  --name coding-agent-01 \
  -- python -m my_agent --task 'fix failing test'

# Credentials are brokered by the gateway, never baked into the image.

The ecosystem is doing the productizing

Adoption is the real signal. Anthropic has paired Claude Managed Agents with OpenShell and BlueField so enterprises can enforce control over the sandboxes where agent work executes. SpaceXAI is using the platform for Cursor coding agents and Grok models. Salesforce integrated OpenShell with Slack so teams can view agent activity and approve or reject permission requests from a channel; SAP is embedding OpenShell with Joule Studio runtime and contributing engineering back. Over a hundred organizations are named, and OpenShell supports agent paths including Claude Code, Codex, GitHub Copilot CLI, Hermes, LangChain Deep Agents, OpenClaw and OpenCode. The breadth of that list is the clearest sign this is infrastructure, not a feature.

# The Open Agent Safety Platform adds out-of-band enforcement.
# Sentry runs on BlueField-4 DPUs and can quarantine in milliseconds.

LAYERS = {
    'runtime': 'OpenShell on NVIDIA Vera CPU (secure sandbox boundary)',
    'watchdog': 'Sentry on BlueField-4 DPU (in-silicon, out-of-band)',
    'policy': 'gateway (control plane) + supervisor (per-sandbox)',
    'verify': 'policy prover (formal verification of access bounds)',
}

Every allow and deny is logged for a full audit trail

Why "outside the reasoning loop" is the whole idea

Prompt-injection defense, identity, credential handling and audit are the same problem viewed from four angles: who is allowed to do what, and who can be trusted to enforce it. If the enforcer is the model, an injection becomes a policy change. If the enforcer is the harness, a bug in the harness becomes a breach. OpenShell's design puts the enforcer in the infrastructure layer, where policies are out of reach of the agent. Credentials are brokered by the gateway, not baked into the image, so even a fully compromised agent has nothing durable to steal. And every decision is logged, which is what a regulator will actually ask for. For a security team, that audit trail is often the difference between a pilot and a production rollout.

# Monday-morning checklist before you hand an agent a credential.

CHECKLIST = [
    'inventory every agent, its tools and its reachable scopes',
    'deny by default; grant intent-based permissions, not broad access',
    'keep credentials in the gateway, out of the agent image',
    'log every allow/deny for a full audit trail',
    'quarantine on boundary breach in milliseconds, not minutes',
]

A practical adoption checklist

Start with inventory: list every agent, the tools it can call and the scopes it can actually reach. Then deny by default and grant intent-based permissions rather than broad access. Move credentials into the gateway and rotate them; stop baking them into images. Log every allow and deny for a full audit trail. Finally, aim for millisecond quarantine on boundary breach, not minutes - the difference between the two is measured in leaked data. Inventory first, always; you cannot govern an agent you have not found. OpenShell is not a replacement for your identity provider, secret store or observability stack; it is the runtime boundary that lets all of them hold together while an agent does real work.