Nvidia’s OpenShell sets deny-by-default controls for AI agents
Nvidia’s open-source OpenShell runtime limits agent access through sandboxes and policy checks, with Red Hat named in its broader safety effort.
By Colin Brandt · Enterprise Reporter
· 3 min read
Nvidia announced its Open Agent Safety Platform on Sept. 28, including OpenShell, an open-source runtime intended to impose enforceable limits on AI agents. For teams evaluating Nvidia OpenShell AI agent security, the relevant claim is architectural: the software puts the agent in a sandbox and routes permitted access through policy controls outside the agent workload.
The announcement does not disclose a price, revenue figure or customer count. Nvidia positions OpenShell as the software runtime within a broader platform that also includes Sentry, a separate reference design for hardware-isolated monitoring and enforcement on BlueField-4 DPUs.
How does Nvidia OpenShell restrict AI agents?
OpenShell is not a model-level safety system. It is a runtime designed to govern what an agent can access while the agent runs, without requiring teams to rewrite the agent, according to Nvidia. The company says the runtime can apply policy to file access, system calls and network connections.
Its default network posture is restrictive. Nvidia’s documentation says an agent workload runs in an isolated sandbox whose only allowed outbound path is a protected connection to a trusted supervisor. The supervisor, which sits outside the agent’s boundary, evaluates requests against policy, resolves approved destinations, opens permitted connections and supplies credentials only where policy allows.
That structure is meant to keep actual credentials out of the agent workload. It also means that an agent cannot directly decide its own network permissions. Nvidia says policies can set boundaries for files, processes, network destinations, API calls and the destinations where provider credentials may be used.
OpenShell also includes a policy prover that checks proposed permission changes before they take effect. Nvidia says it can flag expansions such as access to a new credentialed host, a new HTTP method or cloud-metadata endpoints. A flagged change is not automatically approved and requires human review. That check does not guarantee policy is correct: the security outcome still depends on the policies teams write and the operating controls around them.
What is the difference between OpenShell and Nvidia Sentry?
OpenShell is the software runtime boundary. Sentry is Nvidia’s separate, out-of-band safeguard, which the company says runs on BlueField-4 DPUs and monitors agent behavior from a host-isolated layer. Nvidia attributes granular controls over access to data, tools, APIs and services to that wider platform and its Sentry and DOCA components, rather than to OpenShell alone.
Red Hat’s role is narrower than a joint OpenShell launch. Nvidia lists Red Hat among organizations joining the Open Agent Safety Platform effort, and Nvidia’s reference material outlines OpenShift-based profiles for running agent workspaces, including persistent virtual-machine workspaces and sandboxed container sessions. The material describes a path to OpenShell inside those environments, not OpenShell as the default runtime in every OpenShift deployment.
At KubeCon + CloudNativeCon NA in November, Red Hat engineer Derek Carr said agents need deny-by-default networking and a policy framework that records what occurred. Those are requirements he described amid concerns about prompt injection and data exposure; they are not an independent validation of OpenShell’s effectiveness. Nvidia’s OpenShift reference design also says signed-policy verification, signing-key custody and policy activation remain implementation responsibilities.
This story draws on original reporting from SiliconANGLE.
