OpenShell – A safe, private runtime for fleets of autonomous AI agents

	OpenShell – A safe, private runtime for fleets of autonomous AI agents(github.com)
	499 points by niemandhier 3 days ago \| 217 comments
	tl;dr: OpenShell is an NVIDIA-developed runtime that sandboxes autonomous AI agents, using kernel-level enforcement to control file access, syscalls, and network connections, while injecting credentials only for approved endpoints. Policy changes are checked via formal verification to flag risky new access (e.g., new hosts or API methods) before approval. It ships with a CLI, gateway, Kubernetes/Helm deployment, SDKs for Python/TypeScript/Go/Rust, and runs on Linux, macOS (Apple Silicon), or WSL 2.
	HN Discussion: ↑Addresses collective agent permissions and collusion risks beyond individual sandboxing ~Mentions existing alternative tools solving similar network/credential problems ↓Skeptical that you can give agents broad capability while maintaining true security ↑Containerizing agents is essential and this tool helps manage that ↑Formal verification and security-by-construction is the only viable path forward