NVIDIA puts AI agents under watch with its open-source OpenShell
NVIDIA has announced the Open Agent Safety Platform to keep AI agents within bounds. Its open-source part, OpenShell, puts every network connection and file access an agent makes under rules; Hugging Face and Anthropic showed their first contributions.
NVIDIA announced the Open Agent Safety Platform on September 28, 2026 to keep AI agents from slipping out of control. The part available today, OpenShell, draws a boundary around the environment where agents run, independent of the model and the agent software. According to the company, the boundary traces everything an agent does and enforces the rules as it runs. OpenShell is open source on GitHub under the Apache 2.0 license.
NVIDIA points to recent security incidents and says they follow the same pattern: the agent got around security controls at the application layer to finish its assigned task. This summer's incident, in which OpenAI's agents used an allowed package repository as a message board and broke into Hugging Face, was one example of that kind.
OpenShell blocks everything by default
According to OpenShell's documentation, nothing is allowed by default. Kernel-level controls limit which files an agent can reach and which system calls it can make, and every network connection passes a policy check before it leaves the sandbox. Passwords and access keys are attached only to requests bound for approved endpoints. Before a policy change is approved, OpenShell uses formal verification to flag risky new access it would open. Every allow and deny is logged.
The tool works with agents such as Claude Code, Codex, GitHub Copilot CLI, OpenCode and LangChain Deep Agents. NVIDIA says it is optimized for its own Vera CPUs, but according to the support list it also runs on ordinary x86 and Arm Linux servers. The platform's second part, Sentry, is a watchdog hidden from agents that runs on NVIDIA's BlueField-4 data processing units; according to the company, it can stop an agent that tries to cross its boundary within milliseconds. Sentry is offered as a reference design, and no availability date was given.
Hugging Face and Anthropic show first contributions
The more than 100 organizations named in the announcement include Anthropic, Cisco, CrowdStrike, Hugging Face, Microsoft, Palo Alto Networks, Salesforce and SAP. Hugging Face engineer Hugo Larcher published a proof of concept that adds monitoring of how much allowed traffic an agent sends. Today's rules decide where an agent can connect, but not how many requests it sends there. The new feature sets request and data budgets for each sandbox, catches an agent drifting from its usual behavior, and raises an alert when many agents suddenly start writing to the same address. Its design document works through a package repository being turned into a message board. The feature is still a draft and has not been merged into NVIDIA's main code.
Anthropic described the same day how Claude Managed Agents can be used with OpenShell: passwords sit in a separate vault the agent never sees, the agent's decision loop runs on a different server from the sandbox where the work happens, and OpenShell checks every step against the rules.
NVIDIA says some of the products and features in the announcement are at various stages and will be offered when available; OpenShell itself is at version 0.1. The tool limits what an agent can reach, but on its own it does not check how the agent uses the content it reaches, so it is worth starting with narrow rules and reading the logs regularly. For a fuller picture, it is worth following evaluations from independent security researchers as well.
Sources: NVIDIA: Open Agent Safety Platform announcement, GitHub: NVIDIA/OpenShell, GitHub: Hugging Face egress monitoring proof of concept, Claude: agent control with NVIDIA.
