NVIDIA has contributed OpenShell to the Cloud Native Computing Foundation as a Sandbox project. The runtime applies infrastructure-level limits to autonomous agents’ access to data, credentials and networks. Its move to a neutral project home brings public governance and contribution processes, while NVIDIA continues engineering work and other organisations help develop integrations and security controls.
NVIDIA has contributed OpenShell, a runtime that constrains autonomous AI agents, to the Cloud Native Computing Foundation, or CNCF. The foundation welcomed it as a Sandbox project at KubeCon + CloudNativeCon North America. Sandbox is the starting stage for projects in the foundation’s ecosystem. The change places an existing security project under community governance, with NVIDIA continuing its core engineering contribution.[1], [2]
OpenShell monitors behaviour and applies boundaries within the infrastructure where an agent runs. Access to data, credentials and networks is controlled outside the model’s own decisions. The project is adopting Cedar, a CNCF policy-language project, to express those rules. Contributors from NVIDIA, Red Hat, Docker and Canonical have been involved since the project began. Extension points allow connections to computing providers, inference services, credential stores and approval workflows.[1]
The repository is moving from NVIDIA’s GitHub space to the neutral ai-openshell organisation. OpenShell has adopted the foundation’s code of conduct and a public process for discussing proposed changes. Working groups will address components and shared concerns such as observability. Contribution areas include audit events, conformance tests, reproducible packaging and multi-tenant deployments. These are areas for further engineering as the project develops within the CNCF Sandbox.[1]
