OpenShell – A safe, private runtime for fleets of autonomous AI agents

Each agent runs in its own sandbox, where kernel controls limit which files it can open and which system calls it can make. Every network connection passes through a policy check before it leaves the sandbox. Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints. Before a policy change takes effect, formal verification flags risky new access it would grant, such as reaching a new host with credentials or calling a new API method, so those changes wait for human review. Released under Apache 2.0 at GTC on March 16, 2026, OpenShell provides three core enforcement components. It is part of NVIDIA Agent Toolkit, and NVIDIA has since described it as broadly available. Reviewers have called it alpha software, so its maturity remains an open question. Anthropic has also worked with NVIDIA on the agent stack, with Claude Managed Agents establish a security boundary by running the agent loop in a separate server from the sandboxes where their work executes. For a team building an AI company, the notable design choice is that access rules sit outside the agent's own code. It wraps existing agents (Claude Code, OpenClaw, Codex, OpenCode) in policy-enforced isolation without requiring code changes to the agent itself. Permission changes can be reviewed like other infrastructure changes, which lowers the cost of letting agents touch repositories, APIs and cloud credentials. Alpha-stage tooling still warrants a pilot before production use.