NVIDIA OpenShell: A Default-Deny Agent Sandbox, Now Paired With Claude Managed Agents

Our verdict: OpenShell is the right design for agent sandboxing, and it is too early to trust it alone. Default-deny, credentials the agent never sees, and a formal check on policy changes are the controls every recent agent escape we have covered was missing. But NVIDIA OpenShell is a 0.1.x release, and its anonymous telemetry is on until you turn it off. That matches its conditional rating in our directory, the same rating we give Docker Sandboxes. Try it on agents you already run unattended, and keep your other controls in place. We have not tested it ourselves.

What happened

On 28 September 2026, Anthropic published a Claude Blog post pairing Claude Managed Agents with NVIDIA OpenShell.

• The split: in Claude Managed Agents, "the agent loop that handles orchestration, context management, and error recovery stays on Anthropic's infrastructure, while each session's tool calls run in an environment you control."
• Credentials: "the harness, session state, and credentials live outside the sandbox on durable infrastructure." Teams "can start with narrow permissions, review the log, and use Claude to tighten the rules toward the least access a task needs."
• Availability: "Claude Managed Agents is available today in public beta," in a sandbox you run yourself or one from a managed provider.
• OpenShell's model: it "blocks everything unless a rule allows it" and "logs every decision it allows or blocks." Anthropic adds that "OpenShell's policy prover then uses mathematical proof to confirm what the agent can reach under the rules the team wrote."
• License: OpenShell is open source under Apache 2.0, on GitHub.

The OpenShell README fills in the rest:

• Version: "New in OpenShell 0.1.x: a stable release cadence, new isolation primitives, an expanded extension surface, and new APIs."
• Enforcement: kernel-level instrumentation enforces policy on file access and system calls, and network connections are checked against policy before they leave the sandbox.
• Credentials: "Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints."
• Policy changes: formal verification flags risky new access, such as reaching a new host with credentials or calling a new API method, and those changes wait for human review.
• Runs on: Linux, macOS on Apple Silicon, and Windows under WSL 2 (experimental), using Docker, Podman or host virtualization. SDKs ship for Python, TypeScript, Go and Rust.
• Telemetry: anonymous and on by default. Set OPENSHELL_TELEMETRY_ENABLED=false, or server.telemetryEnabled=false in Helm, to turn it off.

Why it matters

Agent escapes and leaked credentials are the failure we keep writing about, and most fixes so far have been vendor promises. OpenShell is a deployable, open tool that attacks both: nothing gets out unless a rule allows it, and the agent never holds the real secret it would leak. The policy prover is the unusual part. Instead of hoping a rule set is tight, a team gets a proof of what the agent can reach.

The caveat is maturity. Our directory's nearest comparison, Docker Sandboxes, runs agents in a microVM with deny-by-default networking and proxy-injected credentials, and it sits at conditional partly because releases from 0.28.0 until the 0.42.0 fix carried a critical macOS host-file escape. OpenShell has no such record yet, but at 0.1.x it has also had very little time in the field.

What changes for you

• Turn telemetry off with OPENSHELL_TELEMETRY_ENABLED=false unless you are happy to send anonymous telemetry to NVIDIA.
• Check your agent works under it. The README quickstart runs OpenCode against a free OpenRouter model, and the README does not list which other coding agents are supported. Do not assume yours is.
• Treat 0.1.x as a pilot. Keep network egress and credential controls outside the sandbox too, so one bug in a young runtime is not your only line of defence.
• If you are on Claude Managed Agents, OpenShell is one sandbox option among self-hosted and managed providers, not a requirement.