NVIDIA Put the Agent’s Security Outside the Agent, Which Is the Only Place It Works

Every agent safety measure built so far has shared one weakness. It lives inside the thing it is trying to constrain. A system prompt that says do not touch the credentials file is a suggestion to a model that has already read the credentials file.

NVIDIA’s answer is to move the decision out. OpenShell is an open source runtime, Apache 2.0, that sits between an agent and the machine it runs on, and it makes every call on access from a process the agent cannot reach.

What it actually does

Each agent runs in a sandbox with no direct network access. Inside that boundary the workload gets one non-root identity and no Linux capabilities. Landlock restricts which files it can reach, seccomp filters system calls, and every outbound connection is forwarded to a supervisor running on the trusted side.

The supervisor is the interesting part. It sees which binary made a request, checks the destination and the method against policy, and only then attaches credentials. The agent never holds a real token. It asks, and the supervisor decides whether the ask is permitted and what it is permitted to carry.

That pattern is the browser tab model applied to agents. Sessions are isolated, and authority is verified before anything executes.

The formal verification is the part nobody else has

OpenShell includes a policy prover that runs before a policy change takes effect. It uses formal logic to check whether a proposed rule stays inside the operator’s boundary, and it flags specific risks such as new credentialed reach to a host, a new HTTP method on an existing endpoint, or access to cloud metadata services.

Any finding blocks automatic approval and sends the change to a human. The prover also ships as a standalone command so it can run in CI.

This matters more than it sounds. Every agent platform eventually lets the agent propose changes to its own permissions, because that is how an autonomous system gets unstuck. The moment you allow that, you need to answer a hard question about what the proposal would actually grant. Doing that by reading YAML is not a real answer at scale. Doing it with a verifier is.

Will it matter, and what happens next

Technically it is the most complete answer to agent containment that has shipped. The design is defensible at every layer, it runs agents like Claude Code and Codex unmodified, and it supports Docker, Podman, Kubernetes and VM isolation behind the same policy model.

The commercial question is harder. An individual developer installing one coding agent does not need a gateway, a supervisor, a policy prover and a control plane. They need Claude Code to behave, and Anthropic’s own guardrails are adequate for that person. OpenShell earns its complexity at fleet scale, which means a platform team running dozens of agents against production systems with credentials that matter.

There is a second dynamic that cuts against adoption. NVIDIA’s incentive is to be the runtime layer under everyone else’s agent, which is a strong position if it holds. But the same capabilities are arriving inside the harnesses themselves, and Kubernetes is already where most enterprises run isolated workloads. OpenShell has to be meaningfully better than a pod with a network policy, and for a lot of shops it will not be worth the extra moving parts yet.

The routing feature is the one to watch.

Buried in the architecture is a privacy router. It keeps sensitive context on local open models and escalates to a frontier model only where policy allows, and it makes that decision on cost and privacy grounds rather than letting the agent choose.

That is the same shift visible in the usage numbers right now, where the cheapest credible models carry the bulk of routed traffic. OpenShell turns a buyer’s instinct into an enforced rule. If that idea takes hold, it changes the shape of every inference bill in the industry, because the expensive model stops being the default and becomes the exception that policy has to justify.

NVIDIA’s technical walkthrough describes the same model. OpenShell is available at the NVIDIA OpenShell repository and documented at NVIDIA’s OpenShell documentation. Our coverage of the model routing shift is here.