OpenShell

Mon, 01 Jan 0001 00:00:00 +0000

OpenShell is an open-source runtime for fleets of autonomous AI agents. An agent is useful because it can read files, run commands, call APIs, and use credentials; that is also the capability profile of a compromised workload. OpenShell leaves the agent free to plan and use tools, and enforces what it may touch outside the model. Three pieces do the work: a gateway manages sandboxes and their policies, a supervisor sits outside the workload and inspects every outbound request, and the sandbox confines the process with kernel controls — Landlock on the filesystem, seccomp on system calls, and user and network namespaces — so the only network path is through the supervisor. Credentials stay outside the agent and are attached only to requests bound for an approved endpoint. Policy is written in YAML, compiled to OPA/Rego, and checked by a prover before a change is applied, so a requested permission can be shown to cross a boundary even if the agent argues that it does not. Denials come back as structured OCSF events rather than silent failures. Prompt guardrails still matter, but they are not the boundary: a model that has been talked into misbehaving keeps whatever credentials it was given unless the runtime never put them there.

Sandbox on François Duthilleul

OpenShell