github.devotd.
NewSecurity

nvidia/openshell v0.1.5 — Agent Isolation Sandbox and Kernel-Level Policy

nvidia/openshell is a Rust-written, Apache-2.0-licensed runtime for autonomous AI agent sandboxes that controls file, process, and network access through kernel-level policy; the latest release is v0.1.5.

Repositorynvidia/openshell ↗

nvidia/openshell is a Rust-written, Apache-2.0-licensed runtime for autonomous AI agent sandboxes that controls file, process, and network access through kernel-level policy; the latest release is v0.1.5.

GitHub description: OpenShell is the safe, private runtime for autonomous AI agents.

stars
★ 16.9K
Forks
1.8K
Language
Rust
License
Apache-2.0
Latest release
v0.1.5
Read original source ↗View on GitHub ↗

nvidia/openshell is a Rust project published on GitHub: a runtime that runs autonomous AI agents inside isolated sandboxes (separate environments that seal off each agent). The README describes the repository as a safe and private runtime for fleets of autonomous AI agents (running many agents together). It is released under the Apache-2.0 license, and the latest release shown on the repository is v0.1.5. However, the change log and release notes for that version are not in the given material, so what this release changed cannot be confirmed.

The purpose is to set a security boundary for the execution environment when several agents run together. File access, processes, and network connections are bound by policy at the kernel level, and real credentials are added only to requests directed at approved endpoints. Policy changes are checked with schema validation to confirm newly permitted risky access, and risky changes wait for human review. The star count is 16884.

That said, the verifiable range is narrow. There are no benchmarks or adoption cases showing what level of isolation the kernel-level control produces, and no comparison with other sandboxing approaches either. The only score left in the research record is the momentum score, 8.2 out of 10; novelty, technical, and quality scores are not given. The repository is also an early project, created on February 24, 2026. Its structure matches the purpose of an agent execution environment, but separate verification is needed to judge the strength of the isolation and the effectiveness of the security boundary.