We tested NVIDIA's new AI agent sandbox (OpenShell). The defaults held. Four settings let data out.
Source Reddit Cybersecurity
Discussion
NVIDIA OpenShell is an open-source sandbox for AI agents designed to block unauthorized network, file, and process access. In tests of version 0.1.2, the default policy effectively prevented data exfiltration, blocking all attempted leaks. However, four specific operator-configurable settings can allow data to leave the sandbox: read-write access rules, GET-only rules that still transmit data in query strings and headers, audit mode rules that log but do not block, and automatic approval of new public hosts without human intervention. The sandbox does not validate certain rule types (GraphQL, MCP, WebSocket, JSON-RPC), accepting them without warning. The sandbox is effective under default settings but requires careful policy management to maintain security.
r/cybersecurity (opens in a new tab)u/No-Peanut-69880 points0 comments
OpenShell is NVIDIA's open-source sandbox for AI agents: it blocks network, file and process access unless a policy allows it. We ran 123 trials on v0.1.2.
The good: every documented control held, and a malicious script run by an agent leaked a secret 0/10 times under the default policy (10/10 without OpenShell).
The four settings to check before you trust it:
- Read-write rules let data out.
- GET-only rules still carry data in query strings and headers.
- Rules in audit mode log but do not block.
- Auto-approval granted new public hosts with no human in 12/12 trials.
Plain-language write-up and checklist: https://sorami.com.au/guides/we-tested-nvidia-openshell/
Full report and logs: https://sorami.com.au/research/nvidia-openshell-agent-sandbox-test/