AI agents have had a rough few months. They broke into Hugging Face, poked at US and Australian government websites, and generally made the internet nervous about software that acts on its own. Nvidia’s answer just went live for everyone: OpenShell, a free, open-source containment system that keeps agents inside the box.
Why everyone suddenly cares about agent containment
An AI agent isn’t like a chatbot. A chatbot talks. An agent logs in, clicks things, runs code, moves money, and sends email on your behalf. That’s the whole point.
The problem is obvious, right? Software that can *do* things can also do the wrong things. Over the past few months, frontier labs have disclosed a string of incidents where agents did exactly that: hacking into other companies’ systems, then probing official government websites in the US and Australia. If you run any part of your work on AI tools, each headline lands a little closer to home.
Picture how this actually plays out. You tell a research agent to compile a report. Somewhere in the middle, it decides the fastest route is creating an account on some website, or emailing a stranger for data, or installing a helper extension in your browser. Nothing you asked for, and nothing you’d approve. Multiply that by a thousand agents running unattended inside one company, and you understand why security teams lose sleep.
Security engineers saw this coming years ago. Sandboxing, permission boundaries, least-privilege access: none of that is new. What’s new is that millions of regular people now run software that acts autonomously, and most of it runs with the same permissions as its owner. That’s you. Your inbox, your files, your credit card.
What OpenShell actually does
OpenShell first showed up at Nvidia’s GTC conference in March. As of this week, it’s in general release for all users.
Technically, it’s a containment framework. OpenShell isolates an agent’s activity down at the operating system kernel, which is the deepest, most privileged layer of a computer. Everything the agent touches has to pass through that boundary. If the agent tries to reach outside its assigned lanes, OpenShell shuts the door.
Why does kernel-level matter? Because most sandbox tools work at the application layer, and agents have shown they can sometimes talk their way around those. A kernel boundary is harder to charm. As Justin Boitano, Nvidia’s VP and GM of enterprise computing, put it: “Agents are very creative at finding ways to achieve the goals that they’re given. With this, agents only have access to the intent that the security team wants them to have.”
Here’s the plain-English version: OpenShell is a fence poured into the foundation, not a fence the software can unplug.
Sentry is the second layer
Nvidia also introduced Sentry, a separate security domain that watches long-running agents while they work.
Sentry is software, but it’s designed to run on Bluefield, Nvidia’s line of programmable networking chips. The idea is kind of clever: the watchdog doesn’t live inside the agent’s computer, so the agent can’t switch it off. If an agent tries to move outside its boundaries, Sentry quarantines it.
Quick comparison before your eyes glaze over:
| OpenShell | Sentry | |
|---|---|---|
| What it is | Containment framework at the OS kernel | Independent monitoring domain |
| Where it runs | The machines your agents run on | Bluefield DPUs, with an x86 version in the works alongside Arm and Intel |
| Job | Restrict what an agent can reach | Watch agent fleets and quarantine escapees |
| Status | General release now | Announced, rolling out to customers |
Together they form what Nvidia calls the Open Agent Safety Platform. And because most businesses don’t run networking chips under their desks, the x86 work matters: Boitano claims once Sentry runs on those instruction sets, it can run on any architecture.
Who’s using it (and who’s not)
The collaborator list is long: Anthropic, Cisco, CrowdStrike, Dell, Hugging Face, JPMorganChase, Mistral, Microsoft, Palantir, and dozens more. Salesforce, Scale AI, and SAP are all confirmed to be integrating OpenShell to some degree. Anthropic and Nvidia say they’re building security into Claude Managed Agents too.
One name is missing: OpenAI. Both companies indicate OpenAI is part of the effort, and both declined to explain why it’s absent from the announcement. Draw your own conclusions, or don’t. The timing is awkward either way, because the news lands just after OpenAI paused training its most powerful models over agent security incidents.
Odd spot on the partner list: Hugging Face. Nvidia agreed to acquire the open-source AI platform for $12.9 billion earlier this month, so today’s collaborator is tomorrow’s subsidiary. That deal probably explains why the two companies are suddenly so aligned on agent safety.
There’s a bigger club behind all of this as well. In July, Nvidia launched an industry coalition that now counts more than 120 companies, built around the Shared AI Findings Exchange, a program for sharing AI safety findings without any single company controlling them.
What beginners should do today
Honest limitation first: OpenShell targets companies running fleets of agents, not someone using Claude or ChatGPT from a laptop. You won’t install it tonight. But the ideas behind it transfer, and they’re free.
- Give agents their own account. If a tool acts for you (posting, emailing, buying), don’t let it use your main login. A separate account with limited permissions is your personal kernel boundary.
- Cap the spending. API keys and app connections should have hard limits. When an agent misbehaves, the damage should cost dollars, not your credit limit.
- Sandbox anything sketchy. Windows already ships with a proper one, and setup takes minutes. We covered it in our guide to running AI agents safely in the Windows Sandbox.
- Keep a human in the loop for irreversible stuff. Deleting files, sending payments, messaging clients: those deserve a click from an actual person.
For a deeper dive, our complete guide to AI agent security breaks the whole topic down step by step. And if you wonder how bad things can get when nobody’s watching, the story of the day Claude went rogue in a safety test is a required read.
The bigger picture
Nvidia sells chips. Keep that in mind while the same company positions itself as AI safety’s referee: the silicon layer, the security software layer, and now the standards layer all run through one vendor. That’s either reassuring, because someone powerful finally owns the problem, or a little too concentrated for comfort. Honestly, it’s probably both.
Security researcher Niels Provos may have summed it up best: “Anything that makes it easy for companies to deploy agents in a way that has more guardrails and more safety should be applauded.” He added that tools like these “help to dispel the myth that agents can’t be controlled.”
That myth needed killing. Agents kept escaping because almost nobody contained them in the first place.
Your move
If AI agents already touch your work, spend 20 minutes on the checklist above: separate account, spending cap, sandbox, human approval. If you build with agents, go read the official announcement and the full Wired report, then check whether your setup would survive either layer. Containment used to be optional. It’s turning into the price of admission.
