NVIDIA releases OpenShell 0.1.0 agent runtime

NVIDIA has released version 0.1.0 of OpenShell, an open-source runtime that sets and enforces which systems, data and credentials an AI agent can use. According to an NVIDIA technical blog post, it combines sandboxed execution, controlled service access, credential management and formal policy analysis. It supports Codex, Claude Code, Pi and Hermes.

OpenShell has three components. A Gateway manages the lifecycles and policies of many sandboxes. A Supervisor, paired with each sandbox, runs outside the agent and checks outbound requests against policy. The Sandbox uses operating-system kernel controls to limit filesystem and process access, and its only network path runs through the supervisor.

The supervisor can inspect configured HTTP, GraphQL and Model Context Protocol (MCP) traffic. That lets a policy allow a data query but block a write through the same API. These controls still apply when an agent starts a shell, runs generated code, launches child processes or hands work to sub-agents. Policies are written in YAML and compiled to OPA/Rego. Decisions are logged in an Open Cybersecurity Schema Framework (OCSF) audit trail.

Other 0.1.0 features include multi-tenant support and formal verification that shows whether requested permissions stay within set boundaries. Real credentials stay outside the agent and are bound to authorized requests. Workloads can run on CPUs or GPUs in containers, VMs and Kubernetes.

NVIDIA named three adopters. Cadence uses OpenShell for chip design, Slack is building an on-demand agent platform on it, and Gecko Robotics uses it to govern agents that make decisions on physical robots. OpenShell is the runtime layer of NVIDIA's Open Agent Safety Platform.