[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f17m455updiud1":3},{"code":4,"message":5,"data":6,"timestamp":53},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":41,"summary_md":42,"topic":43,"github_topics":46,"license":47,"homepage":48,"updated_at":49,"history":50},"NVIDIA\u002FOpenShell",1,"OpenShell is the safe, private runtime for autonomous AI agents.","Rust",19325,1922,893,241,[16,22,27,33,37],{"id":17,"title":18,"points":19,"comments":20,"posted_at":21},50198675,"OpenShell – A safe, private runtime for fleets of autonomous AI agents",496,217,"2026-10-22",{"id":23,"title":24,"points":25,"comments":8,"posted_at":26},47404566,"OpenShell: Nvidia's sandbox for AI agents like OpenClaw",4,"2026-03-16",{"id":28,"title":29,"points":30,"comments":31,"posted_at":32},49933338,"Nvidia\u002FOpenShell: Safe, private runtime for autonomous AI agents",2,0,"2026-10-02",{"id":34,"title":35,"points":30,"comments":31,"posted_at":36},47851034,"Nvidia OpenShell: safe, private runtime for autonomous AI agents","2026-04-21",{"id":38,"title":39,"points":30,"comments":31,"posted_at":40},47415185,"OpenShell – private runtime for autonomous AI agents","2026-03-17","A sandboxed runtime that lets autonomous agents touch files, APIs and credentials under enforced policy.","## The problem\n\nAgents are only useful once they can read files, install packages, call APIs and use credentials — and that is exactly when they become dangerous. Teams currently handle this by giving an agent a container and a service account, then hoping nothing leaves the network. OpenShell addresses the gap between \"agent can do real work\" and \"agent cannot exfiltrate your data\": each agent runs in an isolated sandbox, and a declared policy governs file access, syscalls and outbound connections at runtime.\n\n## What's different\n\nMost agent sandboxes are containers with a restricted image and a network proxy bolted on; policy lives in configuration that is checked at build time or not at all. OpenShell enforces at the kernel level per access, and — the more unusual part — runs formal verification over proposed policy changes before they are applied, flagging things like a new host reachable with credentials. A second differentiator is credential handling: agents never see the real secret, which is injected only into requests bound for approved endpoints. Compared with general container isolation (Docker, Kubernetes NetworkPolicy) this is agent-aware; compared with hosted agent platforms it keeps the control plane on your own infrastructure, including a Helm-deployed gateway.\n\n## Who it's for\n\nPlatform and security engineers at organizations actually running fleets of coding or ops agents with real filesystem and network reach — the ones who get asked \"what can this agent reach?\" and currently have no good answer. It also suits teams deploying agents in regulated or multi-tenant environments where the gateway needs to be self-hosted. Solo developers experimenting with a single agent should look elsewhere: a plain container plus a scoped API key covers that case with far less machinery, and the policy authoring and approval workflow would just be overhead.\n\n## Cost of adoption\n\nLinux, Apple Silicon macOS, or Windows via WSL 2 (experimental), plus Docker, Podman or host virtualization. The Kubernetes path requires a CNI that actually enforces `NetworkPolicy` — a real infrastructure constraint, not a checkbox. Installation is a single shell script from the repo. The project is young (created February 2026) and the README itself calls 0.1.x the start of a stable release cadence, so expect API and policy-schema movement; it also collects anonymous telemetry by default, which some environments will want disabled. License is Apache-2.0, which is permissive, but you are adopting a pre-1.0 control plane.\n\n## Verdict\n\nThis is a brand-new project with unusually large early attention: ~19.2k stars at 241 days old, +9,666 in the past month (#6 on the monthly board), and a 496-point Hacker News thread — interest is concentrated in a single spike rather than a long track record, so treat popularity as a signal of relevance, not of maturity. The kernel-level enforcement plus verified policy diffing is a genuinely differentiated angle, and NVIDIA's backing makes sustained maintenance plausible. The risk is that the interesting half — formal verification of policy changes — is the part most likely to be thin or opinionated at 0.1.x, and the whole design assumes you are willing to run a gateway. Worth a serious evaluation if you are putting agents near production data; not worth it if you just want a container.",{"slug":44,"name":45},"ai-engineering","AI Engineering",[],"Apache-2.0","https:\u002F\u002Fdocs.nvidia.com\u002Fopenshell\u002Flatest\u002F","2026-10-24T15:05:40Z",[51],{"date":52,"stars":11,"stars_gained":13},"2026-10-24",1792866638]