Kevin's avatar
Kevin
Part time degen

NVIDIA OpenShell puts the agent's guard outside the agent. The open standards around it are not ready.

Oct 22, 2026. About AI agents, sandboxes, and agent identity.

On October 21, 2026, at GTC Berlin, NVIDIA announced the OpenShell Reference Architecture for safe AI agents (NVIDIA Newsroom). The timing lines up with AGNTCon and MCPCon, which open in San Jose on October 22. Forkast describes that week as a gap between products that shipped and standards that are still drafts (Forkast via CryptoRank).

I read the press release, the technical blog, the docs, and the GitHub repo. Here is what OpenShell is, how it works, and what is real today.

OpenShell is two things with one name

The name covers two layers, and the coverage often mixes them up.

The runtime is the part a developer can install today. The reference architecture is the part NVIDIA sells.

The supervisor decides, and the agent cannot reach it

The core idea, in NVIDIA's words, is that "an agent cannot govern itself" (NVIDIA Technical Blog). OpenShell treats every agent as untrusted and puts the rules in the infrastructure around it. The architecture docs describe four main parts.

A network request goes through five steps.

  1. The agent opens a TCP connection or makes a DNS lookup.
  2. The sandbox identifies which program made the request.
  3. The sandbox sends the request to the supervisor over one authenticated HTTP/2 connection.
  4. The supervisor checks policy and adds any credentials that policy allows.
  5. If the request is allowed, the supervisor opens the real connection.

The docs list three details that matter for security. The agent never sees real credentials. If the supervisor disconnects, the sandbox freezes the agent. A new supervisor cannot take over a running sandbox, even with valid tokens.

The policy prover is the part I find most interesting. An agent can propose new network rules. If a rule would give new credentialed access, new HTTP methods, or access to cloud metadata endpoints, the prover blocks auto-approval and a human must review it. The prover also ships as a standalone openshell-prover command for CI.

Shipped, vendor-measured, and draft

The status of each piece differs, so I list them separately.

The long partner list does not tell you much either. The release groups companies that are "integrating support" and companies "working with" OpenShell. Some partners have shipped. ServiceNow announced general availability of ServiceNow Arc, with actions enforced by OpenShell. For most of the other partners, the release describes intent, not products.

The standards between agents and companies are still drafts

OpenShell controls what an agent can do inside your infrastructure. It does not say how an agent proves who it is to someone else's service. That part is still open.

Personal Agent Protocol, or Poppy, is the clearest example. Sierra and Meta announced it on October 6, 2026, and Sierra published a v0.1 draft on October 9 (Sierra). It defines discovery through a /.well-known/poppy.json file, OAuth sign-in, and one session across a company's website, APIs, and its own agent. The changelog says draft 0.2 is in progress and may break code written against 0.1. The reference implementation is not out yet.

Okta is less clear than the Forkast summary suggests. Okta said Okta for AI Agents would be generally available on April 30, 2026 (Okta). Agent Gateway, the part that checks every agent call to a tool and swaps in short-lived credentials, is a research release that customers must request access to (Okta, July 2026). So the identity directory is available, and the runtime enforcement piece is not GA. I could not confirm a shipped integration between Okta Agent Gateway and OpenShell beyond OIDC sign-in and the press release partner list.

My view

The OpenShell runtime is the useful part of this launch. Putting the policy decision in a process that the agent cannot reach is the right design. It is open source, and you can test it on a laptop with Docker today. If you run coding agents or long-running agents with real credentials, try it.

The reference architecture is a reason to buy NVIDIA hardware. Enforcement in silicon on BlueField can be useful, but it ties your control point to one vendor, and the speed claims are NVIDIA's own. Wait for independent numbers before you plan around them.

The larger gap is between companies. An OpenShell supervisor can stop an agent from leaking a key. It cannot tell a bank which person the agent acts for. Poppy and Okta's gateway aim at that problem, and neither is final. Until one is, every agent stack will build its own bridge. Nothing here is financial advice.

Sources