NVIDIA introduced OpenShell 0.1.0 on September 28, 2026, as an open-source runtime for adding enforceable controls around an existing AI agent. The agent can still interpret instructions, choose tools, and adapt its approach, while the runtime enforces boundaries around files, networks, credentials, APIs, and processes outside the workload.
OpenShell is organized around a Gateway, Supervisor, and Sandbox. The Gateway manages sandbox lifecycles and policies; a Supervisor outside each workload checks outbound requests; and the Sandbox uses kernel-level controls for files and processes while allowing network traffic only through the Supervisor. The design moves enforcement away from prompts and agent explanations into a control layer that can be applied at runtime.
NVIDIA says the Supervisor can inspect HTTP, GraphQL, and Model Context Protocol traffic. It can allow a read from an API while blocking a write to the same service. The controls remain in place when an agent starts a shell, runs generated code, launches child processes, or delegates to sub-agents, and policy decisions are recorded in an OCSF audit trail.
Credential protection is another central feature. The agent receives a placeholder while the Supervisor substitutes the real credential outside the workload only for an approved endpoint and provider profile. If the placeholder is sent somewhere outside the approved destination, OpenShell rejects it. This separates having access to a credential from controlling how an agent may use it.
When an agent discovers that it needs a new service or data source, the policy advisor can propose a narrowly scoped network or file-policy change. The proposal remains pending for human review by default, and the agent cannot approve its own request. NVIDIA also describes a formal policy prover that checks whether a modeled permission stays inside an operator-defined boundary and identifies concrete actions that would cross it.
NVIDIA names Cadence, Slack, and Gecko Robotics as adoption examples across chip design, enterprise automation, and physical-robot governance. Those are vendor-reported examples, not independent outcome studies. Production deployments still need to examine compute drivers, identity middleware, policy maintenance, audit retention, and recovery paths when a control blocks useful work.
For enterprise agents, OpenShell represents a shift from telling an agent not to do something toward blocking an unauthorized action even when the agent generates the command. It does not replace threat modeling, least privilege, human approval, or end-to-end testing, but it can provide a clearer enforcement boundary for long-running agents that call tools.
