NVIDIA/OpenShellSource publication:
Loading content…
NVIDIA released OpenShell 0.1.x, a runtime that lets fleets of autonomous AI agents read files, install packages, call APIs and use credentials without unrestricted access to data, secrets or network. Each agent runs in an isolated sandbox where kernel controls confine file access and system calls, every network connection passes a policy check before leaving, and agents never see real credentials. Before a policy change is approved, formal verification flags risky new access it would grant, such as reaching a new host with credentials, and those changes wait for human review.
Autonomous AI agents can read files, install packages, call APIs and use credentials, and OpenShell places those capabilities inside a policy-bound runtime instead of giving agents direct reach into data, secrets and network. The prior condition is an agent holding those capabilities with unrestricted access to data, secrets or network; OpenShell instead has the user declare what each agent can touch and enforces that declaration. The constraint rests on two mechanisms together: the kernel enforces policy on every file access, system call and network connection at runtime, and formal verification checks what a policy change would allow before it is applied.
Each agent runs in an isolated sandbox, kernel controls confine which files it can access and which system calls it can make, and every network connection passes a policy check before it leaves the sandbox. Credentials are not handed to the agent in real form; OpenShell adds them only to requests bound for approved endpoints. Before a policy change is approved, formal verification flags risky new access it would grant, such as reaching a new host with credentials or calling a new API method, and those changes wait for human review.
After installation a sandbox can be created: the installer sets up the CLI and a local gateway, and the default sandbox image is minimal Ubuntu with no agent installed. Running a real agent follows the first-agent tutorial, which runs OpenCode against a free OpenRouter model and shows how to approve new access as the agent needs it. The runtime requires Linux, macOS on Apple Silicon, or Windows with WSL 2 (experimental), plus Docker, Podman or host virtualization.
The demonstrated scope is the runtime mechanisms and install path of OpenShell 0.1.x: isolated sandboxes, kernel-level policy enforcement, credentials added only at approved endpoints, formal verification before policy changes, and gateway, provider and Kubernetes deployment; it addresses researchers and engineers who need to run autonomous agents in a controlled setting.
The release notes label WSL 2 support on Windows as experimental and require the CNI to enforce NetworkPolicy for Kubernetes deployment; formal verification is described as flagging risky new access before a policy change is approved, not as replacing human review.
