An AI agent sandbox is a controlled runtime that decides what an autonomous agent can touch while it works: which files, which network calls, which credentials. NVIDIA’s OpenShell is the biggest mainstream push yet. It enforces the rules and traces every action the agent takes. It still won’t decide, action by action, whether your agent should send that message at all.
TL;DR: NVIDIA entered agent safety on Sep 28 with OpenShell, an open-source secure runtime boundary that traces every agent action and enforces policy, backed by a silicon watchdog called Sentry. That solves containment. The other half, deciding which actions deserve a human yes, stays with the owner, and almost nothing on the market serves individual owners there.
What NVIDIA actually shipped
NVIDIA announced the Open Agent Safety Platform on Sep 28, 2026. It has two parts.
OpenShell is the software half: an open-source secure runtime that, in NVIDIA’s words, “traces all actions and enforces policy” while agents run. It ships on NVIDIA’s Vera CPUs and, because the code is open, can be extended to Arm and Intel machines. The repo is Apache 2.0 licensed and held roughly 19,700 GitHub stars at the time of writing.
Sentry is the hardware half: a reference design that runs a watchdog on NVIDIA BlueField-4 DPUs, outside the agent’s view. If an agent tries to step outside its boundary, Sentry quarantines it in milliseconds. NVIDIA describes it as invisible to agents and attackers, which is the point: a boundary the agent can see is a boundary the agent can negotiate with.
Reception has been loud. The Hacker News thread hit 500 points, and NVIDIA lists more than 100 partner organizations, including Anthropic, Salesforce, SAP, and Microsoft.
What an AI agent sandbox actually controls
Strip away the press language and OpenShell answers one question: what is this agent allowed to touch while it runs?
| Layer | What it decides | Who sets it |
|---|---|---|
| Runtime boundary (OpenShell) | Which files, network calls, and credentials the agent can reach; keeps a full action trace | Whoever writes the policy |
| Out-of-band watchdog (Sentry) | Whether the agent broke out of its boundary; quarantines it in milliseconds | The operator running the infrastructure |
| Per-action judgment | Whether this specific message, payment, or post should go out at all | You, the owner |
The first two layers are what NVIDIA built. The third is where the press release goes quiet, and it is the layer individual owners actually feel.
Enforcement is not judgment
NVIDIA’s own launch partners make the distinction visible. The announcement describes Salesforce integrating OpenShell with Slack so teams can view agent activity and “approving or rejecting agent requests for additional permissions.” SpaceXAI’s president put it plainly: “Customers should be able to set those limits for Cursor and Grok and trust they will hold.”
Someone still has to say yes. Containment guarantees the agent operates inside whatever box you drew. It cannot tell you whether the box was right for this morning’s task.
The pattern behind the whole announcement is a one-line admission in NVIDIA’s own release: across recent security incidents, “the agent circumvented security controls at the application layer to complete its assigned task.” Read that twice. The agent was doing its job. The failure was that nobody upstream judged whether this particular completion was acceptable before it hit the real world. A sandbox would have traced it; a policy would have blocked the specific escape; the judgment call still had to come from a person.
Enterprises get a person, a security team, and now a Slack integration. If you run three agents on your own machine, you get the box and a log file.
The gap we measured in September
This is the layer we looked at directly. On Sep 1 we scanned the five agent platforms we track most closely: Marqea, AmpPilot, Tycoon, VenturOS, and Magister. All five bundle approval and audit as a feature of their own platform, a “review and ship inside our app” model. None of them ships a neutral gate that can audit any agent on your machine, including agents from other vendors.
That matters because your agents already come from several places. A gate that only watches one vendor’s agents is a gate with most of the doors removed. We laid out the full argument in the three permission gates every autonomous agent needs, and the design lesson from running our own queue daily: the record of what happened belongs next to the approval, in the same row, or you re-open the log every time you wonder what a “yes” actually caused.
One honest caveat: NVIDIA arriving compresses this window. Words like “boundary,” “policy,” and “trace” are going mainstream, and platform-level enforcement is getting serious. That is good for everyone buying agents. It also means the interesting open question has moved: the enforceable box is being built top-down for enterprises, while the owner-level question, who approves what for the agents on my machine, is still mostly unserved.
What to do if you run agents today
You do not need to wait for hardware watchdogs. Four practices cover most of the risk:
- List the actions that deserve a human gate before they leave your machine. Outbound messages, payments, deletions, anything that touches another person. Everything else can run free; a gate on everything is a gate on nothing.
- Keep the action trace somewhere the agent cannot edit. If the only record of what your agent did lives inside the agent, you have a witness with amnesia.
- Grant narrow, expiring permissions instead of blanket allow-always. The failure mode has a name now; see what Allow Always cost one Marketplace seller.
- Review the queue daily, and treat rubber-stamping as a design bug. If you approve everything by Tuesday, the queue is too noisy; approval fatigue is a symptom, not the problem.
Platforms are adding their own enforcement too, and the account ban wave of 2026 showed what happens to agents that act without authorization on someone else’s turf. A sandbox plus your own review queue keeps you on the right side of that line.
Where this lands
OpenShell is real progress: an open-source boundary with teeth. It answers “what can this agent touch.” The question that decides whether your agent earns trust, “should it do this particular thing,” still arrives at your desk, one action at a time.
If your agents already do real work, the gate takes minutes to add. CrossMind queues your agents’ outbound actions for individual approval and you can clear a day’s queue in a couple of minutes. The output is a readable record of every action your agents took and what actually happened. Start at crossmind.io.