NVIDIA has handed OpenShell, its open source runtime for securing and governing AI agents, to the Cloud Native Computing Foundation (CNCF). The CNCF announced on Nov 10, 2026, at KubeCon + CloudNativeCon North America, that it "welcomes OpenShell as a Sandbox project." The code will move from NVIDIA's GitHub account to a neutral organization, and the CNCF says NVIDIA's core engineering work will continue.
What OpenShell is
The OpenShell README on GitHub calls it "the safe, private runtime for fleets of autonomous AI agents." It says OpenShell gives agents file, package, API and credential access "without giving them unrestricted access to your data, secrets, or network." You write down what each agent can touch in a policy, and OpenShell enforces it.
Per the same README, it works in two ways:
- Kernel-level enforcement. Each agent runs in an isolated sandbox. Kernel controls limit which files it can access and which system calls it can make, and every network connection passes a policy check before it leaves the sandbox. Agents never see real credentials. OpenShell adds them only to requests bound for approved endpoints.
- Checked policy changes. Before a policy change is approved, OpenShell uses formal verification to flag risky new access it would grant, such as reaching a new host with credentials or calling a new API method. Those changes wait for human review.
The NVIDIA blog post on the donation says OpenShell "applies deterministic controls to agent activity" as agents use tools, reach inference services and run workloads.
For how approval prompts work inside agent apps, see our explainer on AI agent permissions and approvals.
What changes with the CNCF move
The CNCF post, written by CNCF's Jonathan Bryce and NVIDIA's Ali Golshan, lists the changes:
- New home. OpenShell is moving from NVIDIA's GitHub repository to a neutral organization, ai-openshell. Until the move is complete, the README asks people to keep using the NVIDIA/OpenShell repo for code, issues and pull requests.
- Governance. The project has adopted the CNCF Code of Conduct, runs a public RFC process, and follows a governance model with "explicit vendor-neutrality commitments."
- Policy language. OpenShell is adopting Cedar, another CNCF project, as its policy language.
- NVIDIA stays. "The core engineering efforts from NVIDIA will continue," the post says.
The post also says core contributors from NVIDIA, Red Hat, Docker and Canonical have worked on the project since it started. Sandbox is the CNCF's entry-level tier, per The New Stack. The CNCF projects page describes Sandbox projects as "Experimental projects not yet widely tested in production."
How widely it is used
These figures come from NVIDIA and from interviews:
- NVIDIA's blog says "Hundreds of organizations have put OpenShell to use" and that the project "has received tens of thousands of contributions in less than a year since launch."
- The New Stack reports that roughly 10 to 15 companies were contributing when NVIDIA opened early access in March, per Golshan, and that the CNCF's project page now lists about 380 contributing organizations.
- Golshan told The New Stack that about 50 to 60 companies have built on OpenShell so far.
The project dropped its alpha label with the 0.1.0 release in September, per The New Stack.
Why a Kubernetes foundation, not the AAIF
The New Stack notes that the Linux Foundation, the CNCF's parent, also runs the Agentic AI Foundation (AAIF), which hosts agentgateway, MCP and A2A, and that the AAIF took in Alibaba's OpenSandbox last month. We covered that move here.
Golshan's reason, as quoted by The New Stack: "Securing and creating trust around AI is really infrastructure. That's really where you need to start." In the same piece, Bryce describes the AAIF as oriented toward the front-end experience of agents, and calls the foundations "Venn diagrams" and not silos.
Agent Substrate: the companion project
NVIDIA's blog pairs the donation with a second project. NVIDIA is also contributing to Agent Substrate, which it describes as "an open source Google-led framework for operating long-running agent workloads at scale on Kubernetes" that has been accepted into the CNCF Sandbox.
Per NVIDIA, Agent Substrate keeps agent environments between tasks but frees compute when agents are idle. NVIDIA says it and Google are "collaborating on an integration of OpenShell and Agent Substrate."
What is still open
- Security process. Golshan told The New Stack the team is "spending a bunch of time thinking through" how to put an independent security committee around the project, including how to handle disclosures and vulnerabilities.
- Platform support. The CNCF post asks for help with broader support across Linux, macOS and Kubernetes, plus security reviews and adversarial testing.
- Integrations. CNCF executive director Jonathan Bryce expects answers over the next six to 12 months on how OpenShell works with Kata Containers, gVisor, Agent Substrate and OpenTelemetry, per The New Stack.
How to try it
OpenShell is open source under the Apache 2.0 license. The README quickstart installs a CLI and a local gateway with one script, then creates a sandbox with openshell sandbox create --name demo. The default sandbox image has no agent installed. The OpenShell docs cover sandboxes, policies, providers and Kubernetes deployment.
For a managed option from another vendor, see how Gemini managed agents can now run tools in your own sandbox.
Sources
- CNCF: Welcoming OpenShell to the CNCF (Nov 10, 2026)
- NVIDIA Blog: NVIDIA Expands Open Source Commitment With OpenShell Donation and New AI Infrastructure (Nov 10, 2026)
- OpenShell README on GitHub
- ai-openshell GitHub organization
- OpenShell documentation
- CNCF projects page
- The New Stack: Why Nvidia gave OpenShell to the CNCF (Nov 11, 2026)
