NVIDIA 开源项目 OpenShell 进入 CNCF Sandbox
NVIDIA 把管 agent 执行安全的项目 OpenShell 交给 CNCF 了，做策略隔离、网络限制、凭证托管三件事。做 agent 的开发者可以看看，跟只在 prompt 层做防护的思路不一样，喜欢社区治理的可以去贡献代码。
NVIDIA 宣布将 OpenShell 捐赠给 CNCF，进入 CNCF Sandbox 孵化，项目聚焦 AI agent 的运行时安全。
OpenShell 为自主运行的 agent 提供策略隔离、网络控制和凭证管理三类能力，防止 agent 在执行代码时越权访问数据或泄露密钥。项目定位与 prompt 层的安全防护互补，主张把安全边界做在运行时层而非提示词层。
CNCF Sandbox 是其孵化早期开源项目的入口，意味着该规范将由社区共同治理。对正在构建 agent 应用的开发者，这是一个可以直接贡献和落地的执行环境安全方案。
OpenShell is joining @CloudNativeFdn 💚 Help shape how AI agents access data, use credentials, and execute code. If you’re building agents, we’d love your input! Check out the project and contribute 👇 CNCF @CloudNativeFdn Securing AI agents starts at the runtime layer, not just in prompts. OpenShell is now in the CNCF Sandbox, bringing policy isolation, network controls, and credential management to autonomous agents. Read more: cncf.io/announcements/… #OpenSource #AI 🔗 View Quoted Tweet📊 5 ⚡
This report is categorized under AITOP's "Products" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and US-China foundation model benchmarks and commercialization comparison. Key entities and technical topics under continuous tracking include OpenShell, NVIDIA, CNCF, 智能体.
Source attribution: curated from NVIDIA AI (@NVIDIAAI). Cross-source corroboration: 11 independent sources have covered this development (including marktechpost, Techsauce, TestingCatalog), confirming industry-wide signal strength.
