Post

NVIDIA's OpenShell runs AI agent fleets in kernel-enforced sandboxes: deny-by-default egress, and credentials the agent never holds. 17,600 stars, Apache 2.0. The control layer most agent rollouts are missing: https://www.secureinseconds.com/blog/2026-10-24-nvidia-openshell-ai-agent-sandboxing