The most reassuring sentence NVIDIA published at GTC Berlin is buried in the OpenShell architecture docs, where the project promises that an agent’s sandbox has nothing worth stealing. No signing key, no gateway token and no provider credentials live on the agent’s side of the boundary. The API keys get attached to traffic after it leaves, and only when policy says the destination is approved.
That design sits under the OpenShell Reference Architecture Jensen Huang announced in Berlin on October 21, and it is the part platform teams can install today. The OpenShell repo is Apache 2.0, dates to February, and shipped v0.1.5 on October 20. The partner list got the stage time, but platform teams need to see how the supervisor, the network fence and the policy prover fit together, and a couple of defaults deserve a change before anyone shares a cluster. Our GTC Berlin keynote recap covers the rest of what NVIDIA announced on stage.
The Agent Asks and the Supervisor Decides
OpenShell splits every sandbox across a trust line. The sandbox process lives with the untrusted agent, launches it as a child, identifies which program made each request from trusted /proc data, and forwards TCP and DNS traffic without deciding anything. The supervisor lives on the trusted side, checks each request against policy, resolves DNS, adds credentials and opens the real connection. The gateway above both is the control plane, managing sandbox lifecycles, delivering policy and deciding who can do what.
The architecture docs walk a single network request through five steps, and they read like a firewall rulebook written for an agent.
- The agent opens a TCP connection or makes a DNS lookup.
- The sandbox identifies the calling program.
- The request travels over the OpenShell Sandbox Protocol to the supervisor.
- The supervisor checks policy and adds any credentials policy allows.
- If allowed, the supervisor opens the real connection and relays traffic.
On Linux the workload runs as one non-root identity with no capabilities, Landlock limits filesystem access, and seccomp user notification stages network operations so nothing leaves before the supervisor answers. The outer network fence denies all other egress, so the agent cannot reach DNS, the gateway or another private address directly.
Credentials Show Up Only on the Way Out
Providers map a service name to a stored credential, and the supervisor hands that credential out only where policy allows it. The gateway is the only component that signs anything, and it issues a pair of JWTs for each run of a sandbox, which the docs call a generation. Restarting a sandbox starts a new generation with fresh tokens and fresh TLS certificates, and the old ones stop working.
The failure behavior is the detail I would show a security reviewer first. If the supervisor disconnects, the sandbox freezes the agent, and only that same supervisor process can reconnect and resume it. A new supervisor cannot take over a running sandbox even with valid credentials, which closes off the obvious attack of standing up a friendlier supervisor next to a compromised workload.
Kubernetes Gets a Pod, a NetworkPolicy and a Warning About Your CNI
Every runtime follows the same contract with its own native tools. Docker and Podman put the supervisor in its own container and turn off networking for the workload container, VMs talk over authenticated vsock with no guest network device, and Kubernetes gives the supervisor its own pod reachable over a private service with mutual TLS. On Kubernetes the supervisor proves its identity by presenting its pod’s ServiceAccount token, which the gateway verifies against its own record of the sandbox before issuing any JWTs.
The Kubernetes setup guide deploys the gateway with Helm, and the README includes a warning worth taping to your monitor, your CNI must enforce NetworkPolicy. If yours silently ignores it, the outer fence is decorative. The docs also tell shared deployments to set gateway_jwt.ttl_secs so tokens expire, while local single-user gateways can leave it unset and get tokens that last the life of the sandbox run.
Run the Prover Before the Agent Asks for More
Agents propose new network rules as they work, and the policy prover runs in the gateway to check those proposals with formal verification. It flags new credentialed reach, new HTTP methods and access to cloud metadata endpoints, and any finding blocks auto-approval so a human has to look. NVIDIA’s technical blog describes the same component as checking whether a policy stays inside an organization-defined ceiling.
The prover also ships as a standalone CLI, which means you can drop it into CI next to your other policy checks. The docs show exporting a running sandbox’s policy and checking it against a boundary file.
openshell sandbox get my-sandbox --policy-only > candidate.yaml
openshell-prover check candidate.yaml --boundary boundary.yamlWriting boundary.yaml is the real work, because it forces your team to agree on the maximum an agent may ever touch before anyone argues about a specific request.
Telemetry, Silicon and the Rest of the Fine Print
OpenShell collects anonymous telemetry by default, limited to operational categories and counts, and the README says it excludes sandbox names, hostnames, prompts, credentials and user content. You can turn it off with OPENSHELL_TELEMETRY_ENABLED=false on the gateway or server.telemetryEnabled=false in Helm, and regulated shops will want that decision written down before the first pilot.
The hardware story is optional. BlueField-4 DPUs running NVIDIA Sentry add out-of-band monitoring and what NVIDIA calls in-silicon enforcement, and the technical blog frames that layer as an extra safeguard alongside the software boundaries. The quickstart runs on Linux, Apple Silicon Macs, or Windows under WSL 2, which the README marks experimental, so the software boundary is something a laptop can test this afternoon.
Nothing Worth Stealing Is a Testable Claim
Back in March I called agent security a tire fire in my GTC San Jose column. OpenShell is the first piece of NVIDIA’s agent stack I can hand to a platform engineer with a concrete test attached, which is to break into the sandbox and look for a key. Our team at TechForward has not run that red-team exercise yet, and a 0.1 release has earned skepticism along with attention.
Install it with the one-line script in the README, follow Run Your First Agent to watch it ask for access, and read the telemetry page before you roll it to a shared cluster. Then go hunting for something worth stealing.
