"Coding Agents Need Less Authority, Not Just More Capability: How NVIDIA OpenShell Sandboxes Them"

A coding agent becomes a different kind of system the moment you give it a shell.

It can run tests, install packages, edit files, call GitHub, pull dependencies and use external APIs. All of that is useful. It also means the agent is now operating with real authority on your machine.

That is the problem NVIDIA’s OpenShell is trying to address.

OpenShell runs the agent inside a sandbox and keeps the permissions outside it. The agent can ask to do something, but the runtime still decides whether that action is allowed.

One example from the repo makes this very concrete. You can let an agent read from GitHub while blocking the operations that would change anything. It can inspect a repository without automatically gaining permission to create issues or modify resources.

The same idea applies to files, network access and credentials.

A process can be limited to specific paths. Network access can be restricted to particular destinations. API credentials do not have to sit inside the agent environment at all. They can remain on the trusted side and only be attached to requests that match the policy.

OpenShell also has a policy prover that checks whether a proposed network rule would expand access beyond the boundary you defined.

This is the part of agent infrastructure I find more interesting than another framework for planning or tool calling.

Once agents can operate computers for long periods of time, the important question is not just whether they can complete the task.

It is how much authority they need while doing it.

GitHub Repo: https://lnkd.in/dTrtdN8G

OpenShell is NVIDIA's open-source runtime that isolates each agent sandbox in its own container with policy-enforced egress routing, so the agent can ask to do something but the runtime decides whether it's allowed. The GitHub example is real: the default sandbox policy permits read-only access to GitHub and blocks write operations, so an agent can inspect a repo without being able to create issues or change anything. File access is also restricted, since Landlock enforcement confines agents to declared paths only. For credentials, the agent mostly doesn't hold the real secrets. It gets placeholders, and the placeholder resolves only for hosts, ports and paths authorized by the provider profile. A policy prover also exists, but OpenShell does not yet run it automatically on sandbox startup, so the post's claim is real but less automatic than it sounds. Finally, the project is labeled alpha software, which the post doesn't mention.