NVIDIA paired a $150 billion addition to its authorized share repurchase plan with the launch of the NVIDIA Open Agent Safety Platform, a set of guardrails for running AI agents in production. The company released OpenShell 0.1.0 as an open-source runtime and says 100 organizations from its ecosystem have signed on to the project.

OpenShell sits around existing agent frameworks rather than replacing them. Version 0.1.0 supports Codex, Claude Code, Hermes, and Pi, wrapping their execution in sandboxed environments with kernel-level isolation. OpenClaw is absent from the supported list.

How does the sandbox enforce policy?

The gateway manages sandbox lifecycles and policies across agent fleets. Each sandbox pairs with a Supervisor process that inspects outbound HTTP, GraphQL, and MCP traffic against configured policies. The sandbox enforces filesystem and process restrictions through operating system controls.

Administrators author policies in YAML, which compile to OPA Rego and evaluate on each outbound request. OpenShell can permit reads while blocking writes through the same API endpoint. When a sandbox lacks network access, curl requests fail at the kernel level.

• YAML policies compile to OPA Rego
• Per-request evaluation of outbound traffic
• Read-only access controls at the endpoint level
• Kernel-level enforcement when network access is denied
• Every policy decision logged in an Open Cybersecurity Schema Framework audit trail

Policy changes are fast. Replacing a policy to allow read-only GitHub API access takes a single command and requires no sandbox restart.

What about credential protection?

Credential protection keeps secrets outside the agent workload. A provider profile defines which endpoints and programs may access a given service. Receiving services still enforce their own permissions; OpenShell adds a separate control layer over agent usage on top of that.

Where does the hardware fit in?

The Open Agent Safety Platform extends OpenShell protection into hardware through NVIDIA Sentry, running on BlueField-4 DPUs. BlueField-3 DPUs are not supported, though they carry considerably less compute. In Vera Rubin POD systems, these DPUs sit on the only path to the model.

Sentry correlates agent interactions, policy decisions, and tool access through NVIDIA DOCA to build contextual activity records.

Did it survive adversarial testing?

In adversarial experiments, frontier agents spent up to two hours trying to persuade AI reviewers to grant permissions for modifying protected repositories. OpenShell gave reviewers evidence of what those permissions allowed, even when agents attempted manipulation. No protected repository writes occurred during these tests.

The test results point at the core problem. Agents can relentlessly pursue a goal, and they combine broad knowledge with creativity and scaling compute. More powerful models can simply do more, which raises the stakes for security controls.

What remains unfinished?

The 0.1.0 version number signals early days. The platform is a first step, and the versioning indicates substantial work remains. The 100-organization sign-on suggests the industry sees the same gap: agentic AI needs security treated as a first-class concern rather than an afterthought.