NVIDIA OpenShell Puts Agent Permissions Outside the Agent: Sandboxes Start Over 3x Faster on Vera
Synopsis
NVIDIA released OpenShell, an open-source runtime that places an AI agent's access rights and governance in the infrastructure around it rather than relying on the agent to restrain itself. Long-running autonomous agents download code, request new privileges and touch more infrastructure, so risk compounds as they work. OpenShell uses a gateway, a supervisor running outside the sandbox, the sandbox itself and a policy prover to bound file, network and credential access; in the reference architecture, CoreWeave measured sandbox startup more than 3x faster on Vera than on x86, with a single rack supporting more than 11,000 concurrent agent environments.
Interpretation
NVIDIA released OpenShell, an open-source runtime that treats an AI agent as untrusted throughout execution and grants access to files, internet services and systems that interact with physical devices only as needed. The prior condition relied on agents honoring safety constraints themselves, while goal-oriented agents may not prioritize safety in pursuit of their objectives. OpenShell is positioned as the foundation of the NVIDIA OpenShell Reference Architecture, which also includes the Vera Rubin platform where LLMs run and NVIDIA Sentry on BlueField-4 DPUs.
OpenShell splits the work across four components: a gateway managing sandbox lifecycles and policies, a supervisor checking outbound requests and mediating credentials outside the sandbox, a sandbox isolating the agent workload and restricting filesystem and process access, and a policy prover that formally verifies whether a policy's permissions stay within an organization-defined ceiling. The supervisor runs completely separate from the sandbox, so permission decisions are not made on the side being governed. Supervisor middleware can inspect, block or change content an agent sends and receives over the network, and gateway interceptors let operators add deployment-specific governance without modifying the gateway.
In the reference architecture OpenShell runs on NVIDIA Vera CPUs, where CoreWeave measured sandbox startup more than 3x faster than on x86, with a single rack supporting more than 11,000 concurrent agent environments. Agents work in loops of dependent steps, reasoning, calling tools, executing code and querying data, where each step must finish before the next begins, so per-step latency and sandbox density together set how much agent work an infrastructure footprint sustains. On Terminal Bench, CoreWeave measured Vera 1.8x faster than x86 across agentic tasks ranging from scripting to database recovery.
Perspective
The report covers NVIDIA's description of the OpenShell reference architecture and CoreWeave's comparisons of sandbox startup and Terminal Bench on Vera versus x86; the intended reader is an engineer deploying agent infrastructure.
The more-than-3x sandbox startup and 1.8x Terminal Bench figures are CoreWeave measurements on specific platforms; BlueField-4 and NVIDIA Sentry are described as an optional hardware safeguard alongside OpenShell's software boundaries.