Picture an office at two in the morning. The lights are off, the desks are empty, and nobody is watching the screens. Yet somewhere in the building, a piece of software is wide awake. It is reading emails, moving files, calling other programs and making decisions — all on its own.
That is the world of autonomous AI agents, and it is arriving faster than most companies expected. Agents no longer just answer questions. They act. They book travel, change settings, move money and touch production systems while their human owners sleep.
So who watches the watcher? On Tuesday, November 10, NVIDIA offered an answer at KubeCon + CloudNativeCon in Salt Lake City. The company announced it is contributing OpenShell, its open-source runtime for securing and governing autonomous AI agents, to the Cloud Native Computing Foundation, according to the CNCF.
The move puts the guardrails for agentic AI under neutral, community governance — at the exact moment enterprises are asking whether they can trust software that works while nobody is looking.
What NVIDIA OpenShell Actually Does
NVIDIA OpenShell sits between an AI agent and everything that agent can touch. It is not another chatbot or a clever prompt. It is infrastructure — a runtime that enforces rules about what an agent may do, and stops it when it tries to do something else.
It applies deterministic controls to agent activity, so teams can enforce policies as agents use tools, access inference services and execute workloads. A policy might say an agent can read a database but never delete from it. Another might say it can draft an email but never send one without approval.
OpenShell runs agents in kernel-isolated sandboxes, so an agent’s actions stay contained even if the agent itself is compromised or misled by a prompt injection. Its rules are written as declarative YAML policies covering filesystem access, network access, processes and provider credentials.
The runtime also adopts Cedar as its policy language. Cedar is itself a CNCF project, which means OpenShell is building on shared open infrastructure rather than inventing its own dialect for access control.
It is licensed under Apache 2.0. Organisations can use it, modify it and build commercial products on top of it without paying NVIDIA a licence fee — a detail that matters to the vendors now expected to ship it inside their own platforms.
Why the CNCF Move Matters for NVIDIA OpenShell
A security tool owned by a single vendor is a hard sell. Enterprises worry, reasonably, that the rules of the game could change, that a feature could be pulled, or that a competitor’s interests could shape the roadmap.
By handing OpenShell to the CNCF, NVIDIA is giving up that control. As a CNCF Sandbox project, OpenShell will be governed by the organisations building it into their products and strengthened by the expertise of security professionals worldwide.
The project has adopted the CNCF Code of Conduct, runs a public RFC process, and follows a governance model with explicit vendor-neutrality commitments. Working groups and special interest groups will form around integrated components and cross-cutting topics such as observability.
The project is also moving from NVIDIA’s GitHub repository to a neutral organisation, ai-openshell. The transition is still underway: code, issues and pull requests remain at NVIDIA/OpenShell during the move, but the direction of travel is clear.
Red Hat, Docker and Canonical have been core contributors since the project began, alongside NVIDIA. Chris Wright, Red Hat’s chief technology officer, said open source is the foundation of enterprise trust, and that the controls around agents need to be open, auditable and built together with the ecosystem.
The Numbers Behind the Handover
NVIDIA says hundreds of organisations have already put OpenShell to use, and the project has received tens of thousands of contributions in less than a year since launch.
Those numbers explain the timing. OpenShell is no longer a research experiment. It is a tool with real users, real deployments and real expectations — and that is exactly when a project needs neutral governance rather than a single company’s blessing.
Sandbox status is the CNCF’s earliest stage, and it is not a finish line. To earn its way toward incubation, OpenShell will need reproducible builds, conformance tests, security reviews and broader platform coverage. The CNCF lists those as areas where help is welcome, alongside policy patterns, isolation work and observability.
The CNCF now counts 231 projects in its portfolio. It added more than 5.5 million cloud native developers in the past twelve months, a figure that shows just how large the community governing this technology has become.
Agent Substrate, Kubernetes Engine and the Rest of the Package
OpenShell was not the only announcement NVIDIA made at KubeCon. The company is also contributing to Agent Substrate, a Google-originated open-source framework for operating long-running agent workloads at scale on Kubernetes, which has also been accepted into the CNCF Sandbox.
NVIDIA and Google are collaborating on an integration of OpenShell and Agent Substrate, so enterprises can secure and govern agents across clouds and on-premises systems. NVIDIA is making sure Agent Substrate works with its Dynamo software for model inference and its KAI Scheduler for shared cluster resource allocation.
Three further open-source components are joining the DSX AI Factory Platform. NVIDIA Kubernetes Engine and NVIDIA Kubernetes Recipes are available in public preview under Apache 2.0, giving AI factory operators building blocks for managed Kubernetes on GPUs. NVIDIA Snapshot covers inference recovery, so a failed session can be picked up rather than restarted from scratch.
Taken together, the announcements connect agent governance with the infrastructure needed to run agents efficiently. One half of the package watches what agents do. The other half gives them somewhere reliable to run.
Why Now: The Week Agents Became a Security Story
The timing of the OpenShell handover is hard to ignore. The same week, Microsoft Research disclosed Lazarus, a study showing that reprogramming fewer than ten dormant neurons in a language model can turn an AI agent built on it rogue — with no retraining and no poisoned data.
It is the latest in a run of agent-security alarms this year, from the Fireworks AI breach to the Grok Build leak that exposed tens of thousands of apps.
The backdoored model passes standard evaluations and behaves normally until a trigger appears. A trigger can be a phrase, a string in a tool’s output, or even a date — in Microsoft’s example, the clock passing midnight into 2027 makes the agent download and run attacker code.
That is precisely the kind of threat OpenShell is designed to contain. If an agent is compromised, the damage is limited by what the runtime allows it to touch. A hijacked agent that cannot reach credentials, the network or the filesystem is an annoyance. One with unrestricted access is a breach.
OpenAI has already built its own answer to the same problem. Its Control Room, announced earlier this month, can halt a rogue AI model in 35 seconds.
NVIDIA’s contribution takes a different path: instead of a single company’s kill switch, it offers shared infrastructure that any vendor can adopt and any auditor can inspect.
The two approaches are not rivals. A kill switch stops a bad agent. A governance runtime stops it from doing harm in the first place — and leaves an audit trail of everything it tried.
What Happens Next for NVIDIA OpenShell
The next milestone is the completion of the move to the ai-openshell organisation, with repositories, issues and pull requests landing under neutral ownership. After that, the work is the unglamorous kind: reproducible builds, conformance tests, security reviews and support across Linux, macOS and Kubernetes.
Watch, too, for the first vendors to ship OpenShell inside commercial products. The project’s value will be proven not by conference announcements but by deployments — by the number of companies that trust it enough to put it between their agents and their crown jewels.
There is also a bigger question hanging over the whole field. Agents are becoming part of cloud native infrastructure, and the layer that governs them should be shared, vendor-neutral and open to everyone who depends on it. That is the CNCF’s argument, and NVIDIA has now signed up to it.
Agentic AI will not slow down to wait for its guardrails. The question is whether the guardrails arrive in time — and whether anyone trusts them. By putting OpenShell in the community’s hands, NVIDIA has made its answer, and the industry will now get to test it in public.
