How to Run AI Agents Safely: NVIDIA Launches OpenShell

AI agents are genuinely powerful, but did you know they can read files, call APIs, and use your credentials without any "forbidden zone" at all?

What is OpenShell?

NVIDIA OpenShell was just announced at GTC 2026. It is an open-source runtime that creates a safe sandbox for autonomous AI agents such as Claude Code, OpenClaw, or Codex. In simple terms, it builds a "sealed room" for the agent to work in, one it cannot reach beyond what you explicitly allow. Everything is declared in a clear YAML file, so you can read it and immediately understand what the agent can and cannot do.

Four layers of protection, stacked together

OpenShell does not rely on a single security layer. It uses a Defense in Depth strategy built from four layers. The Filesystem layer blocks the agent from reading or writing outside the approved directories, enforced at the kernel level with Landlock LSM. The Network layer controls every outbound connection, so the agent can only reach the APIs you have approved. The Process layer blocks privilege escalation and dangerous syscalls using seccomp. Finally, Inference routing sends AI traffic through a Privacy Router that strips credentials and forwards requests to the model backend you choose.

How fast is setup?

As long as Docker is running, you only need two commands: one to install the CLI via curl, and one to create the sandbox. For Claude Code, for example, running openshell sandbox create -- claude is enough. The CLI automatically detects the API key from the environment and asks for confirmation. There is no need to install a separate Kubernetes cluster, since OpenShell runs a K3s cluster directly inside the Docker container.

The best part: hot-reload policies

You do not need to tear down the sandbox to change a network policy. The workflow is remarkably smooth: check the logs to see which requests were denied, pull the current policy into a YAML file, edit it directly, then push it back with openshell policy set. Everything applies instantly while the agent keeps running. The filesystem and process layers, on the other hand, are locked hard from the start to guarantee absolute safety.

Credentials that never leak

OpenShell manages API keys through a Providers system. Credentials are injected into the sandbox as environment variables and are never stored on the sandbox's filesystem. The agent can use a key but cannot read it or copy it out. Anthropic, OpenAI, OpenRouter, and many other providers are already supported.

Who should care about this?

If you are using an AI agent to write code, deploy software, or automate workflows, OpenShell is a protective layer you should not skip, especially when the agent has access to the filesystem, calls external APIs, or uses sensitive credentials. The tool is free, open source under Apache 2.0, and written in Rust and Python.

What is your AI agent currently allowed to access on your machine? Share in the comments.