# NVIDIA OpenShell

NVIDIA's open-source runtime that sandboxes autonomous AI agents under enforced policy

**Verdict: conditional.** OpenShell is NVIDIA's free, Apache-2.0 runtime that sandboxes autonomous agents with kernel-level file, syscall and network policy, injects credentials only for approved endpoints, and checks policy changes before you approve them. Conditional because it is at 0.1.x, Windows runs through WSL 2 and is marked experimental, and anonymous telemetry is on by default. Right for teams that want to trial policy-enforced agent isolation on Linux or Apple Silicon; we have not tested it. Last verified 2026-10-15.

OpenShell is NVIDIA's open-source runtime for autonomous AI agents, which its README calls "the safe, private runtime for fleets of autonomous AI agents". Agents can read files, install packages, call APIs and use credentials while declared policies are enforced at runtime. Each agent runs in a sandbox whose kernel-level controls restrict file access, system calls and network connections. Credentials are injected only into requests bound for approved endpoints, so agents never see the real credentials. Changes to a policy are verified to flag risky new access before approval, and sensitive changes need human review; the README names a policy advisor and a policy prover, and Anthropic's blog says the prover uses mathematical proof to confirm what an agent can reach. The pieces are sandboxes (images, runtimes, GPU allocation, lifecycle), policies (filesystem, network and process rules), providers (credentials that work only at approved endpoints) and gateways (the control plane for sandboxes and access policies), with Helm deployment on Kubernetes. It installs with a curl script, then `openshell sandbox create`; it needs Linux, macOS on Apple Silicon or Windows with WSL 2 (experimental), plus Docker, Podman or host virtualization. The default sandbox image is a minimal Ubuntu with no agent in it, and the guide walks through running OpenCode against OpenRouter models. SDKs exist for Python, TypeScript, Go and Rust. It is Apache-2.0 licensed and at version 0.1.x: GitHub lists v0.1.0 on September 25, 2026, v0.1.1 on September 26 and v0.1.2 on September 28. Anonymous operational telemetry is on by default and can be turned off with an environment variable; the README says it does not capture sandbox names, hostnames, file paths, prompts, credentials, provider or model names, or user content. Anthropic's September 28, 2026 post describes OpenShell as a separate layer alongside Claude Managed Agents, which keeps credentials in a vault apart from the agent and runs the agent loop on a separate server from the sandbox, while OpenShell blocks everything unless a rule allows it and logs every decision.

## Strengths

- Bounding what an agent can touch: kernel-level controls restrict file access, system calls and network connections per declared policy
- Keeping real credentials away from the agent: they are added only to requests bound for approved endpoints
- Reviewing permission changes: policy changes are verified to flag risky new access before approval, with human review for sensitive ones
- Running many sandboxes under one control plane: gateways manage sandboxes and policies, with Helm deployment on Kubernetes and SDKs for Python, TypeScript, Go and Rust
- A production dependency today: the project is at 0.1.x, with v0.1.0 published on GitHub on September 25, 2026
- Windows-first teams: Windows is supported through WSL 2 and marked experimental
- Environments that cannot allow telemetry: anonymous operational telemetry is on by default and must be turned off with an environment variable
- A ready-to-run agent: the default sandbox image is a minimal Ubuntu with no agent in it

## Pricing

- Model: open-source
- Open source: $0

Website: https://github.com/NVIDIA/OpenShell

## Sources

- [NVIDIA OpenShell GitHub releases](https://github.com/NVIDIA/OpenShell/releases)
- [Anthropic: Giving companies more control over their AI agents with NVIDIA (Sep 28, 2026)](https://claude.com/blog/giving-companies-more-control-over-their-ai-agents-with-nvidia)
- [GitHub: NVIDIA/OpenShell README (Apache-2.0, 0.1.x)](https://github.com/NVIDIA/OpenShell)

Canonical: https://neomanex.com/directory/nvidia-openshell