NVIDIA hands its OpenShell AI agent security runtime to the Cloud Native Computing Foundation

NVIDIA is handing OpenShell, its open-source software for keeping autonomous AI agents within set limits, to the Cloud Native Computing Foundation (CNCF), the Linux Foundation body that hosts Kubernetes. The company announced the contribution on November 10, 2026, at the KubeCon + CloudNativeCon North America conference in Salt Lake City, and the CNCF named OpenShell the same day among the new projects in its Sandbox tier. The foundation's project page says OpenShell was accepted on September 26.

The project's README frames the problem: an agent, an AI system that carries out tasks on its own, is most useful when it can read files, install software, call APIs and use credentials, and OpenShell aims to allow that without giving it free run of a company's data, secrets or network. “AI teams need control over where their models run, what their agents can do, and how their systems behave in production,” said Jonathan Bryce, the CNCF's executive director, in the foundation's announcement.

What OpenShell does

OpenShell enforces policy in the infrastructure around an agent, the CNCF says, governing how agents run, which resources and data they can reach and where their inference requests are sent. Its documentation on GitHub describes the mechanics. Each agent gets an isolated sandbox in which kernel controls restrict the files it can open and the system calls it can make, and each outbound network connection is checked against a policy first. The agent is never handed real credentials: OpenShell inserts them itself, and only into requests to endpoints the policy allows. When someone proposes a policy change, the software uses formal verification to flag risky new access it would open up, for example a new host the agent could reach with credentials or a new API method it could call, and holds such changes for a person to review.

The code is released under the Apache License 2.0. The project's GitHub page says development is moving from NVIDIA's own repository to ai-openshell on GitHub, and governance to the CNCF, and asks contributors to keep using NVIDIA's repository until the move is done.

What changes with a foundation

NVIDIA says that as a CNCF project, OpenShell will be governed by the organizations that build it into their products, with input from security specialists. “NVIDIA's contribution of OpenShell to CNCF gives developers a shared foundation to build on and an opportunity to shape how agent security evolves,” said Jim Zemlin, chief executive of the Linux Foundation, in NVIDIA's announcement.

The Sandbox is the first rung. The CNCF describes it as the entry point for early-stage projects and says it requires them to follow the foundation's legal, code-of-conduct and intellectual-property rules. Projects that mature can move to incubation and then graduation; in the past year, the CNCF says, Kubeflow, used for model training and serving, graduated.

NVIDIA also says the project has drawn tens of thousands of contributions since it launched less than a year ago. Those adoption figures are the company's own.

Part of a wider push on agents

OpenShell was one of several AI projects the CNCF highlighted at the conference, as it said its portfolio now spans 231 projects. Agent Substrate, a Google-led framework for running long-lived agent workloads on Kubernetes, also entered the Sandbox; the CNCF describes it as a zero-trust runtime that isolates untrusted code. NVIDIA says it is contributing to that project as well, making it work with its Dynamo inference software and its KAI Scheduler, and that it is working with Google to integrate Agent Substrate with OpenShell so companies can govern agents across clouds and on-premises systems. The CNCF also listed gVisor, KubeRay and OpenRL among the project contributions it announced that day.

At the same event, NVIDIA announced three open-source infrastructure components: NVIDIA Kubernetes Engine and NVIDIA Kubernetes Recipes, in public preview, for offering managed Kubernetes on GPU systems, and NVIDIA Snapshot, which it says restores saved inference replicas in seconds. NVIDIA says design partner Crusoe cut the time a GLM-5.3 workload took to become ready from about eight minutes to 31 seconds; that result is NVIDIA's account of Crusoe's test.