NVIDIA OpenShell v0.1.2 runs AI agents in a sandbox that enforces network and file access policies using a default deny approach. Sorami's empirical evaluation showed that the default policy blocked all tested exfiltration attempts, with a malicious script leaking secrets 10/10 times without OpenShell and 0/10 times with it. Four operator-controlled policy settings can permit data exfiltration: read-write access rules allow data in POST bodies, query strings, and headers; GET-only rules still transmit data in query strings and headers; audit mode rules log but do not enforce blocking; and automatic approval mode grants new public hosts without human review. The policy prover does not support GraphQL, MCP, WebSocket, and JSON-RPC rules, yet the loader accepts them silently. The sandbox requires careful configuration, especially keeping proposal approval manual and enforcing all Layer 7 rules, to prevent data leaks.

Under the default policy, OpenShell effectively prevents data exfiltration by AI agents, blocking all tested attempts to leak secrets. However, enabling certain policy settings can allow data to be exfiltrated, potentially exposing sensitive information. Automatic approval of new public hosts without human oversight can increase risk by allowing unvetted network access. The acceptance of unsupported rule types without warning could lead to misconfigurations and unintended access. Overall, the sandbox provides a strong boundary but relies heavily on correct operator policy configuration to maintain security.

Use the default deny policy and keep proposal_approval_mode set to manual to prevent automatic approval of new hosts. Enforce all Layer 7 rules rather than using audit mode to ensure blocking rather than just logging. Avoid using read-write access rules unless absolutely necessary, and be aware that GET-only rules can still transmit data in query strings and headers. Run the policy prover in continuous integration to detect unsupported rules and fail builds accordingly. Treat any allowed endpoint as a potential exfiltration path and apply change control to all policy modifications. Verify that logging mechanisms are functioning correctly before relying on them.