NVIDIA gave its AI agent sandbox, OpenShell, to the CNCF. The builder lesson: put your agent's rules outside the agent

What changes. The project moves from NVIDIA's GitHub to a neutral organization, ai-openshell. It is adopting Cedar, another CNCF project, as its policy language. The CNCF says core contributors from NVIDIA, Red Hat, Docker and Canonical have worked on it since the start, and NVIDIA's core engineering continues. NVIDIA says hundreds of organizations use OpenShell and that it has received "tens of thousands of contributions" in less than a year since launch. Those are NVIDIA's numbers; MODEL has not checked them.

Also announced by NVIDIA at KubeCon. It is contributing to Agent Substrate, a Google-led CNCF Sandbox framework for running long-lived agent workloads on Kubernetes, and NVIDIA and Google are working on an OpenShell integration with it. NVIDIA also released NVIDIA Kubernetes Engine and NVIDIA Kubernetes Recipes in public preview, plus NVIDIA Snapshot, which restores checkpointed inference replicas without a model reload.

The builder tip

The CNCF put the core idea in one sentence: giving agents real capability without unchecked access to data, secrets or networks "requires enforcement outside of the agents, right within the infrastructure that the agents run on."

That applies whether or not you ever run OpenShell:

• A prompt is not a permission. "Never touch .env" in a system prompt is a request. A sandbox that cannot read .env is a rule.
• Write the boundary first. List the folders it may write, the hosts it may call, the methods it may use and the secrets it may see. Deny the rest.
• Keep secrets out of the agent's reach. Hand them in through the runtime for a specific call, not as files or environment variables the agent can print.
• Check policy changes like code. When we tested OpenShell's standalone policy prover on Oct. 22 (opens in a new tab) (version 0.1.5), every widening we planted was flagged or refused, and the rule we took away was: only exit code 0 is a pass. Exit 3 (unsupported or inconclusive) is a fail, not a maybe.

The catch. Sandbox is the CNCF's earliest stage. A policy only limits what it covers, and a passing check means "no wider than your boundary," not "safe." Our October test covered only the prover, not a running OpenShell sandbox, and MODEL has not tested the CNCF version.

Disclosure: Not sponsored. No affiliate links. The prover test is MODEL's own; everything else is from CNCF and NVIDIA announcements dated Nov. 10, 2026.

MODEL Editors