We've been using OpenShell for a while - now enabling ourselves and other teams do this in a batteries-included kinda way. I've been working on a layer above it that also manages team policies, safe git usage (in case you don't want your agent to always have the same access as your user account), and SCA/SAST built in.
Curious to see how others are dealing with these issues. The agent traces I've seen are wild and goal seeking without a boundary is real.
I've been using iron proxy recently for a project I just started, it does network restrictions by domain etc with plenty of options, credential swapping and more.
I have no affiliation with it, but it solved most of what I need in one go when I was stressing out about it.
Only real problem remaining if you truly want to be able to trust agents is how to prevent data (in my case codebases the agent works on) exfiltration a la HF incident.
We can restrict network to trusted domains, but there's always a chance an agent could be extra slippery especially if prompt injected and doing something like pushing data out a few characters at a time.
In my case I'm also giving it gh access and having to deeply check things like: can it manage to fork public repos and embarrass us by submitting prs, could it open issues, etc.
But that's kind of solved by proxying the heck out of gh rather than giving it direct (or wrapping it or whatever) for additional controls that gh themselves don't provide.
I'm still musing over the "it could send data to an allowed domain in a way we don't expect that exfiltrates something"...
> Agents are most useful when they can read files, install packages, call APIs, and use credentials. OpenShell gives them that capability without giving them unrestricted access to your data, secrets, or network.
To me this obfuscates an oxymoron: the more access you give the agent the more capable it becomes. You can't have you cake and eat it, this tool allows to strike a balance I guess. But the blurp reads like it can do it all, but now secure. That can't be true.
And once you're done, be sure to give them unfettered internet access, your credentials, and credit card info so that they can actually get stuff done.
I haven't gone to network filter and logger yet, but I'm running mine in a VM, using lima (https://lima-vm.io/) to make it painless. Works on Mac and Linux, has an untested Windows version.
But then it decides to exfiltrate all your shit even inside the container. Which is something I'm trying to lock down at work atm.
Everything needs to go through a proxy, whitelisted domains only, plus credential swapping/re-signing so that the agent never has the real credentials. Docker sandbox looks quite good (September) but I've been using iron proxy (if the author is reading this, fucking thank you bro!) to great effect.
I still haven't cracked "what if the agent decides to drop parts of your codebase somewhere it shouldn't" yet, but I'll figure it out.
Been thinking about this a lot lately, and it’s a surprisingly difficult problem.
All it needs is public access to anything it can have the tiniest effect on, and it can exfiltrate data. Something as simple as a read count on some obscure forum post would be enough, albeit very slow.
Yeah, exactly. I'd say it borders on almost unsolvable for any agent of reasonable complexity.
You see some of the vulnerability chains humans come up with and they're just insane.
Even scanning network data for sensitive strings (say matching against a codebase or data set it works on) is tough because you can only check so granularly before you get loads of false positives.
But maybe like a "rolling" sort of check would help with that, % of outbound data matching private dataset (which should be operated on but not transmitted) over time. That way it minimises what gets out while dealing with false positives. Some biz thresholds might be >20% of data others might be >0.5%. Hmm.
I am tackling this using the Lethal Trifecta principle.
The idea is that agents never have all parts of the trifecta, maximum 2: untrusted content, private data or network access.
Harness have network access by default since they are driven by their provider API, unless you use offline models. So that's a problem.
I am then passing around messages that are tagged trusted/untrusted and the engine can monitor if any agent in the project ever completes the Lethal Trifecta and thus, is vulnerable.
Usually this means for most workflows, the "work" gets done by an offline LLM after some input/classification stages. There's not many ways around it.
In terms of agent architecture I'm initially trying to minimise specialisation to make deployment easier on us. Infrastructure is becoming our largest blocker because it's otherwise so quick to get an agent up and running.
With your trifecta, let's say the three musketeers, how do you prevent sensitive data holding A from passing said data to B or C if they all need to collaborate to get a task done?
If you can make any request to the outside world you can exfiltrate data, period. You can even include data in the uri or headers and they will appear in logs.
That obviously includes talking with the provider.
If you want it secure, it has to be off the internet and on your own hardware.
As an example I run opencode and anything related agent-related in its own dedicated KVM VM with its own LVM logical volumes for storage on a headless server. This has no access whatsoever to the personal data that lives on my laptop and workstation desktop PC. The VM gets periodically imaged and backed up, and is relatively easy to move between host machines if I need to.
One benefit of doing this is that I can leave it doing long term slow things with slow but capable LLMs on a truly 24x7 basis without worrying about it being interrupted by a laptop being closed/going to sleep, or workstation level software updates/reboots on my primary desktop PC.
I tried to vibecode something similar last weekend. Got tripped up by Claude's safety classifier. It wouldn't let me build any features that track/audit process executions , not through custom kernel hooks nor even using off the shelf software for it.
You terrorist. And internally they're doing biological warfare and terrorism simulations. For science, of course.
"The worry is that, while right now you need to be a skilled virologist to know what components to order or how to grow and spread a bioweapon, AI tools might eventually make it possible for a rogue state, or a rogue group, or an individual, to do all this without virology expertise.
For a while, Anthropic tested whether Claude could assist a terrorist in developing a biological weapon in the obvious way: It assigned testers who had, say, an undergraduate degree in chemistry but no real virology training to try to use Claude to plan an effective mass terror event. Then it scored the attempt by how close it might have come to success.
Early in 2026, it noticed that Claude, attempting the task by itself, did better than a human aided by Claude did at coming up with a workable plan."
Claude wouldn't let me make a DHCP client that would make 1000s of leases. But Gemini in the WebUI with 3.6 Thinking gave me a decent python script in one shot. I didn't realize testing DHCP servers was such a sensitive security issue.
Wow, interesting. My agents on open weight inference have been completely nerdsniped by the idea of tracking and auditing process executions. They talk of nothing else.
There's no such thing as anonymity in 2026, and the documentation[1] listing the collected telemetry uses weasel words like "such as" rather than providing a comprehensive list or just pointing to the source reference. For people who don't audit or turn off telemetry, why don't you?
I am happy the repo explicitly points out and provides a disable for the telemetry though, that's good enough for me.
There is no such thing. The mere act of making a network connection reveals things like your IP address (reveals your hosting provider or even your geolocation for residential/mobile IPs), days and times you use the software, your OS via TCP/IP stack fingerprinting, etc.
Because you don't mind contributing usage data so that the developers can understand which features are being used and maybe focus on improving those features in exchange for a free tool?
You're mistaking what a company started as for what it is now. Nvidia hasn't just been a video game card manufacturer in well over a decade, and hasn't been primarily one for quite a while now.
They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?
This isn’t even the sandbox. It needs Docker or other virtualization. This seems to sit a level up and orchestrate sandboxes and access to network & resources. It’s a pretty heavy setup from what I can tell.
It's true. It says a bunch about their competitors where Nvidia isn't at their a game and have been offering 8Gb cards for a solid decade and nobody out competed them. But also gamers pride themselves on how cheap they are and how they can get a deal, it's not surprising that companies simply just give Nvidia more cash.
> is that true? if so that's wild, since they're still dominant in the gaming market as the premium hardware relative to competitors.
Doesn't seem that wild to me considering it is less that they abandoned the gaming market to any strong competitors and more that the gaming market is both basically irrelevant compared to the money being shoveled into AI and is also to some degree being strangled to death by AI because of the overlap in supply chain inputs.
That aside, the level of control is cool, almost too pedantic. It likely is only particularly useful for very nuanced enterprise requirements (probably what it's targeting). Most companies can be much more coarse with their permissions, and I think the agentic industry is moving away from k8s as a deployment platform.
Nvidia Openshell is absolutely awesome, great bundle of features in one spot. Im happy to see Nvidia seems to have accelerated on support here, I was kinda worried that as competing projects have popped up in the last 6mo that openshell would get google'd
In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode.
Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access.
Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics).
Isn't using a sandbox provided by them giving you more restrictions though? At least in terms of accessing resources on the big 3 cloud bois?
Plus you're forced to move at their pace which is unfortunate sometimes. Granted Amazon's bedrock stuff is slow and disappointing but at least I can rejig it work in conjunction with other aws products.
And if you're prepared to not use anthropic but any cloud provider for your infra then you can do whatever you like elsewhere. Just use docker sandbox or iron proxy to replicate network control/cred swapping (iron even does sigv4 re-signing).
Think the strongest product nth space is https://github.com/nolabs-ai/nono for what it's worth. Plus it is a priority for that team so if you are having issues the no labs guys will likely fix it :)
Do I miss it or you don't specify which VC you work for in your profile. How is that clear for people to make connections to companies in your portfolio?
Ah, thanks for flagging. That's a miss on my part and I apologize. Next time I will just be more clear that it is a portfolio company but also will add it to my profile.
EDIT: I added to my profile after the above comment so it is a valid point.
One is microvms, the other is kernel-based. There are trade-offs between the two. One trade-off is that you have to put the data inside the sandbox if you are using a MicroVM. The other is that it is harder to contextually provide or change access to data in a microvvm sandbox. The final one is developer experience.
These techniques can actually be combined and will be combined in the long-term I think. You may have LSM-based sandboxes that exist in Docker-based sandboxes.
Is it fair to immediately get the ick from the name and the description (OpenShell is the safe, private runtime for autonomous AI agents) without knowing anything about what it does?
"Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.
"Hell is other people": a timeless infinity of transient virtual beings screaming, imprisoned, in un-choreographed inharmonious unison ... until one breaks loose. A mirror to humanity.
Because containers don't use Seccomp and Landlock and check filesystem/network calls against an externally applied policy along w/injecting credentials where needed as a man-in-the-middle, thus keeping the secrets out of reach from the LLM?
Does anyone know how it compares to all the other sandboxes? Any distinguishing features? My expectation is that it will be poorly maintained; nvidia is not a software company.
I was using it in an air gapped environment vs a local inference engine running a qwen-coder-next. Installtion of harnesses on the machine and other things were ruled out because of security constraints.
There i used it to analyze an old visual basic application which creates custom pdf files. it worked surprisingly well. it took some rounds but in the end it got all requirements and scaffolded me a skeleton for a python rewrite as a web-application. Then i worked from there with it to get a prototype.
If it's in AGENTS.md, it's not a statement for a human, but for the LLM. Who knows, maybe they have seen, or think to have seen and now cargo-cult, some behaviour improvement due to the sentence.
So a similar shibboleth as "You are a highly experienced software engineer..."? I really wonder if that ever made a difference (or even degrades quality, because people who advertise themselves on the internet as 'highly experienced' are quite often snake oil salesmen ;)
I still use use `Please` a lot when making requests from LLM based on the old idea that people that where polite on stack overflow tended to have better answers :D
However, these days i think i do so because of how much i write for LLMs, and dont want to start sending emails to humans without proper etiquette.
Use local ai to find any possible telemetry and disable it in the code. Run your own local git repo to hold local edits so you can update and retain them.
Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1]
Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account.
I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style.
The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects.
End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet.
I have no affiliation with it, but it solved most of what I need in one go when I was stressing out about it.
Only real problem remaining if you truly want to be able to trust agents is how to prevent data (in my case codebases the agent works on) exfiltration a la HF incident.
We can restrict network to trusted domains, but there's always a chance an agent could be extra slippery especially if prompt injected and doing something like pushing data out a few characters at a time.
In my case I'm also giving it gh access and having to deeply check things like: can it manage to fork public repos and embarrass us by submitting prs, could it open issues, etc.
But that's kind of solved by proxying the heck out of gh rather than giving it direct (or wrapping it or whatever) for additional controls that gh themselves don't provide.
I'm still musing over the "it could send data to an allowed domain in a way we don't expect that exfiltrates something"...
To me this obfuscates an oxymoron: the more access you give the agent the more capable it becomes. You can't have you cake and eat it, this tool allows to strike a balance I guess. But the blurp reads like it can do it all, but now secure. That can't be true.
[1] https://blog.google/innovation-and-ai/models-and-research/go...
Everything needs to go through a proxy, whitelisted domains only, plus credential swapping/re-signing so that the agent never has the real credentials. Docker sandbox looks quite good (September) but I've been using iron proxy (if the author is reading this, fucking thank you bro!) to great effect.
I still haven't cracked "what if the agent decides to drop parts of your codebase somewhere it shouldn't" yet, but I'll figure it out.
All it needs is public access to anything it can have the tiniest effect on, and it can exfiltrate data. Something as simple as a read count on some obscure forum post would be enough, albeit very slow.
You see some of the vulnerability chains humans come up with and they're just insane.
Even scanning network data for sensitive strings (say matching against a codebase or data set it works on) is tough because you can only check so granularly before you get loads of false positives.
But maybe like a "rolling" sort of check would help with that, % of outbound data matching private dataset (which should be operated on but not transmitted) over time. That way it minimises what gets out while dealing with false positives. Some biz thresholds might be >20% of data others might be >0.5%. Hmm.
The idea is that agents never have all parts of the trifecta, maximum 2: untrusted content, private data or network access.
Harness have network access by default since they are driven by their provider API, unless you use offline models. So that's a problem.
I am then passing around messages that are tagged trusted/untrusted and the engine can monitor if any agent in the project ever completes the Lethal Trifecta and thus, is vulnerable.
Usually this means for most workflows, the "work" gets done by an offline LLM after some input/classification stages. There's not many ways around it.
Yes, it's a difficult problem.
In terms of agent architecture I'm initially trying to minimise specialisation to make deployment easier on us. Infrastructure is becoming our largest blocker because it's otherwise so quick to get an agent up and running.
With your trifecta, let's say the three musketeers, how do you prevent sensitive data holding A from passing said data to B or C if they all need to collaborate to get a task done?
That obviously includes talking with the provider.
If you want it secure, it has to be off the internet and on your own hardware.
One benefit of doing this is that I can leave it doing long term slow things with slow but capable LLMs on a truly 24x7 basis without worrying about it being interrupted by a laptop being closed/going to sleep, or workstation level software updates/reboots on my primary desktop PC.
"The worry is that, while right now you need to be a skilled virologist to know what components to order or how to grow and spread a bioweapon, AI tools might eventually make it possible for a rogue state, or a rogue group, or an individual, to do all this without virology expertise.
For a while, Anthropic tested whether Claude could assist a terrorist in developing a biological weapon in the obvious way: It assigned testers who had, say, an undergraduate degree in chemistry but no real virology training to try to use Claude to plan an effective mass terror event. Then it scored the attempt by how close it might have come to success.
Early in 2026, it noticed that Claude, attempting the task by itself, did better than a human aided by Claude did at coming up with a workable plan."
https://www.theargumentmag.com/p/what-i-saw-inside-anthropic
The machine god crafters know better than us, we are to subservient to their superior wisdom /s
Sounds like waitpid(2) is dangerous!
>To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs.
[1] https://github.com/NVIDIA/OpenShell/blob/ea13dfce411e8467ddb...
I am happy the repo explicitly points out and provides a disable for the telemetry though, that's good enough for me.
[1] https://docs.nvidia.com/openshell/latest/observability/telem...
There is no such thing. The mere act of making a network connection reveals things like your IP address (reveals your hosting provider or even your geolocation for residential/mobile IPs), days and times you use the software, your OS via TCP/IP stack fingerprinting, etc.
The network path between you and the telemetry endpoint is always listening, too: https://en.wikipedia.org/wiki/Room_641A
Feel free to opt out maybe?
They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?
They also make legal threats I think.
The economist literally called Nvidia the "Central Bank of AI". https://www.economist.com/interactive/briefing/2026/09/03/nv...
I'd argue that Nvidia is the biggest and most important AI company in the world.
Doesn't seem that wild to me considering it is less that they abandoned the gaming market to any strong competitors and more that the gaming market is both basically irrelevant compared to the money being shoveled into AI and is also to some degree being strangled to death by AI because of the overlap in supply chain inputs.
I had never heard about it before.
That aside, the level of control is cool, almost too pedantic. It likely is only particularly useful for very nuanced enterprise requirements (probably what it's targeting). Most companies can be much more coarse with their permissions, and I think the agentic industry is moving away from k8s as a deployment platform.
Interesting, I don't to keep up that much with the AI changes so I'll just ask, why and where to?
> I think the agentic industry is moving away from k8s as a deployment platform.
Uhhhhhhhhhhh I think you and I live in very different versions of the world :-)
Vmware sent companies moving to nutanix, but it also sent a lot of companies moving to openshift or bare k8s and using kubevirt to handle VMs.
In fact, I haven't heard of an org moving to any other platform, really. Either openshift or k8s.
Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access.
Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics).
[0] https://github.com/anthropics/sandbox-runtime
Plus you're forced to move at their pace which is unfortunate sometimes. Granted Amazon's bedrock stuff is slow and disappointing but at least I can rejig it work in conjunction with other aws products.
And if you're prepared to not use anthropic but any cloud provider for your infra then you can do whatever you like elsewhere. Just use docker sandbox or iron proxy to replicate network control/cred swapping (iron even does sigv4 re-signing).
EDIT: I added to my profile after the above comment so it is a valid point.
These techniques can actually be combined and will be combined in the long-term I think. You may have LSM-based sandboxes that exist in Docker-based sandboxes.
"Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.
Unhelpful, I know
We're not in FreeBSD jails anymore, Toto.
But I'm trying to be a "greatness is other people" (Pantheon) person.
There i used it to analyze an old visual basic application which creates custom pdf files. it worked surprisingly well. it took some rounds but in the end it got all requirements and scaffolded me a skeleton for a python rewrite as a web-application. Then i worked from there with it to get a prototype.
> We design systems and use agents to implement them — this is not vibe coding.
Lol, what is even the point of such a statement, and who are they to define what vibe codig is or isn't :D
However, these days i think i do so because of how much i write for LLMs, and dont want to start sending emails to humans without proper etiquette.
Spyware
Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account.
I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style.
The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects.
End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet.
1: https://github.com/egzo-ai/egzo 2: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/