NVIDIA OpenShell: A Sandbox for Your AI Coding Agent

Your AI coding agent can probably read your API keys right now. If it runs in your terminal as you, it can open any file you can, including the .env sitting in your project. So NVIDIA built it a jail, and it's open source.

What happened

OpenShell is NVIDIA's open-source runtime for AI agents. The repo describes it as "the safe, private runtime for autonomous AI agents." It's Apache-2.0 licensed, written mostly in Rust, and had close to 20,000 GitHub stars when I checked. The latest release, v0.1.5, came out on October 20, 2026.

Here's how it works, from the README:

• One sandbox per agent. Each agent runs isolated, and kernel-level controls limit which files it can open and which system calls it can make.
• Every connection is checked. "Every network connection passes through a policy check before it leaves the sandbox."
• The agent never holds your real keys. "Agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints."
• Risky changes need a human. Before a policy change goes through, OpenShell flags new access that's risky, such as reaching a new host with credentials, and "those changes wait for human review."

It runs on Linux, on macOS with Apple Silicon, and on Windows through WSL 2 (marked experimental), with Docker, Podman or host virtualization underneath. There are SDKs for Python, TypeScript, Go and Rust.

Why it matters for builders

Most of us give coding agents a lot of trust by default. We approve a few commands, then let them run. The risk is concrete: a prompt injection in a README, a malicious package, or just a confused agent can read secrets and send them anywhere.

OpenShell's credential model is the clever part. The agent can call the API it needs, because OpenShell attaches the key on the way out to an approved host. But the agent never has the key itself, so it has nothing to leak. Combine that with outbound network checks and a human sign-off on anything that widens access, and you get an agent that can do real work with a much smaller blast radius.

It's still a 0.1.x project. Treat it as early software, test it on a side project first, and read the policy files before you rely on them.

Try it in 15 minutes

1. Make sure Docker or Podman is running on a supported machine.
2. Install the CLI with the command from the README: curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh. As with any piped install script, read it first.
3. Create your first sandbox: openshell sandbox create --name demo.
4. Follow the README tutorial, which runs the OpenCode agent against a free OpenRouter model inside the sandbox. The default sandbox image ships without an agent, and the tutorial covers that step.
5. Try to break it. Ask the agent to read a file outside its workspace, or to call a host you haven't approved, and watch the policy check stop it.
6. Add one real credential as a provider scoped to one endpoint, and confirm the agent can use the API without ever seeing the key.

If you'd rather wire it into your own tooling, the SDKs install with uv add openshell or npm install @nvidia/openshell-sdk.

Here's how you get paid

My take: every company wants AI agents, and very few know how to lock them down. Security teams are nervous, engineering teams are impatient, and nobody owns the gap between them.

Setting this up is a service. I'd call it agent security setup for teams shipping their first agent:

• Map what the agent needs to touch: which files, which hosts, which APIs.
• Write the sandbox policy and move every secret into scoped credentials the agent never sees.
• Set up the human review step for policy changes and document who approves what.
• Run a short red-team session where you try to make the agent leak something, and hand over the results.
• Offer a monthly review as the team adds tools and widens access.

Sell it to the security lead and the engineering lead together. You're the person who lets the engineers ship and lets security sleep.