News
What Is NVIDIA OpenShell? The Safety Runtime for AI Agents
NVIDIA OpenShell is a free, open-source runtime that fences in AI agents. What it does, the new reference architecture from GTC Berlin, and who it is for.
NVIDIA OpenShell is the software NVIDIA wants every AI agent to run inside. On October 21, 2026, at GTC Berlin, the company turned it into a full "reference architecture" with chips, servers and a long list of partners, and the name started showing up in headlines everywhere.
If you are wondering what OpenShell actually is, whether it is free, and why a chip company is building a jail for AI agents, here is the plain-English answer.
What is NVIDIA OpenShell?
Think of an AI agent as a new employee who works very fast and never sleeps. You would not hand that employee the keys to every room on day one. OpenShell is the badge system. It lets the agent into some rooms and keeps it out of others.
In technical terms, NVIDIA calls OpenShell "the safe, private runtime for autonomous AI agents." It watches every file the agent opens, every system command it runs, and every network connection it makes, and it checks each one against a written policy. If the policy says no, the action does not happen.
NVIDIA first introduced OpenShell at its GTC conference in March 2026, alongside its NemoClaw agent blueprints. The code lives on GitHub at NVIDIA/OpenShell and is now on its 0.1.x release line.
How does NVIDIA OpenShell work?
NVIDIA’s developer blog breaks OpenShell into four parts:
| Part | What it does | Everyday comparison |
|---|---|---|
| Gateway | The control panel that creates sandboxes and manages their rules | The front desk |
| Sandbox | Isolates the agent and limits which files and programs it can reach | A locked office |
| Supervisor | Checks every outgoing request and hands out credentials only to approved sites | A guard at the door |
| Policy prover | Mathematically checks that a new rule never gives more access than the company allows | A lawyer reading the contract first |
The password trick is the clever bit. The agent never holds your real API keys or logins. When it calls an approved service, OpenShell slips the credential into that request on the way out. So even if an agent is tricked by a bad web page, it has no secrets to leak.
What is the OpenShell Reference Architecture?
The October 21 announcement is bigger than the software. It is a recipe for a whole data center built around safe agents. NVIDIA’s release lists these layers:
- Vera Rubin NVL72 systems run the AI models.
- Vera CPUs run the agents themselves and host OpenShell.
- BlueField-4 DPUs run NVIDIA Sentry, a separate security monitor that watches the agent from outside. If an agent steps outside its boundary, NVIDIA says Sentry can quarantine it in milliseconds.
- Edge machines like DGX Spark, DGX Station and RTX Spark bring the same setup to stores, hospitals and factories.
Jensen Huang summed it up as "AI capability and safety must advance together." The core idea is simple: an agent cannot police itself, so the rules have to live in the computer around it.
The partner list is long. Model makers named include Anthropic, Google, Meta, OpenAI, Cohere and Perplexity. Security companies include CrowdStrike, Palo Alto Networks, Okta, Zscaler and 1Password. ServiceNow says its new Arc agent is enforced by OpenShell, and SAP is wiring it into Joule Studio. Banks BBVA and Santander are exploring it.
NVIDIA also gave performance numbers, such as Vera CPUs offering 2x the performance of x86 chips and Sentry boosting agent capacity by up to 20%. CoreWeave reported more than 11,000 agent sandboxes on one rack. These are vendor figures, not independent tests. Unite.AI notes that Sentry itself is planned for early next year, while OpenShell is available today.
Is NVIDIA OpenShell free and open source?
Yes. The OpenShell software is open source under the Apache 2.0 license, so anyone can download, use and change it at no cost. The hardware in the reference architecture is a different story. NVIDIA has not published a price for the full stack, and Vera Rubin systems are data center gear.
How to install NVIDIA OpenShell
The GitHub page offers a one-line installer that sets up the command-line tool and a local gateway, then you create a sandbox with openshell sandbox create. According to the project page, it runs on:
- Linux
- macOS on Apple Silicon
- Windows through WSL 2 (marked experimental)
It needs Docker, Podman or built-in virtualization underneath. The default sandbox is a bare Ubuntu image with no agent inside, so you bring your own. The project’s walkthrough uses the OpenCode coding agent.
NVIDIA OpenShell vs Docker: what is the difference?
Docker puts a program in a box. OpenShell uses a box like that, then adds the agent-specific parts on top: rules for each web request, hidden credentials, and a checker that proves a rule change is safe before it goes live. Docker does not know what an AI agent is. OpenShell is built around one.
One more thing: do not confuse it with Open-Shell, the older open-source Start menu replacement for Windows. Same name, totally different project. If you see "Open-Shell skins" or "Windows 7 Start menu," that is the other one.
What this means for you
OpenShell is a sign of where agents are going. Big companies now trust agents enough to let them run for hours, and they want hard walls around them. Earlier this month, the x401 protocol tackled a similar question from the web side: proving who an agent works for. The first big product to ship on it is ServiceNow Arc, a personal work agent that went generally available the same day.
The same day also showed why hard walls matter: AI-assisted researchers found PHP2Shell, two critical PHP flaws that let one web request take over a server.
But you do not need a data center to get value from agents today. If you just want help writing, researching, planning or studying, a ready-made agent app is the practical answer. Agentic AI gives you a team of expert agents on your iPhone and iPad. You hand it a task, up to four agents work on it together, and you get finished work back. There is nothing to install beyond the app, and the first 3 tasks are free.
New to all this? Start with what agentic AI means, or check terms like "sandbox" in our agentic AI glossary.
Quick answers
What is NVIDIA OpenShell? An open-source runtime from NVIDIA that runs AI agents inside a sandbox and enforces rules on their file access, commands and network connections.
Is NVIDIA OpenShell open source? Yes. It is on GitHub under the Apache 2.0 license and free to use.
When was the OpenShell Reference Architecture announced? October 21, 2026, at NVIDIA GTC Berlin. The software itself first appeared at GTC in March 2026.
Does NVIDIA OpenShell work on Windows or Mac? It runs on Linux and Apple Silicon Macs. Windows support through WSL 2 is labeled experimental. NVIDIA also says Windows support comes through Microsoft Execution Containers in the reference architecture.
Does OpenShell work with Claude Code? NVIDIA lists Anthropic as a partner, but the OpenShell project page does not list supported agents. Its own walkthrough uses OpenCode. You can run your own agent inside the sandbox.
What is NVIDIA Sentry? A security monitor that runs on BlueField-4 chips, separate from the agent, and can stop an agent that breaks its rules. It is planned for early next year.
Sources: NVIDIA newsroom · NVIDIA developer blog · NVIDIA/OpenShell on GitHub · Unite.AI · ADTmag (March launch) · Techstrong.ai
