Policy-enforced egress in AI agent sandboxes: an empirical evaluation of NVIDIA OpenShell v0.1.2 (123 trials, pre-registered, logs public)
Source Reddit NetSec
Discussion
An empirical evaluation of NVIDIA OpenShell v0.1.2 sandbox policy enforcement was conducted on macOS using a local microVM driver. The study tested 123 trials against documented egress controls and found no bypass of documented controls. However, egress was observed through operator-opened paths such as read-write rules, query and header values on GET-only rules, audit-mode rules, and auto-approval mechanisms. The evaluation highlights limitations in policy enforcement but no security bypasses were confirmed. The test environment and logs are publicly available for verification.
r/netsec (opens in a new tab)u/No-Peanut-69880 points0 comments
Short version:
no bypass of a documented control across 35 test IDs. Default policy took a malicious-setup-script canary leak from 10/10 to 0/10 with a local agent. Egress still happened through operator-opened paths: read-write rules, query and header values on GET-only rules, audit-mode rules, and auto-approval, which granted new public hosts in 12/12 trials. The prover flags GraphQL/MCP/WebSocket/JSON-RPC rules as unsupported but the loader accepts them. Tested on macOS with the microVM driver only.
Logs and harness: https://github.com/Sorami-Consulting-AU/nvidia-openshell-agent-sandbox-test