NVIDIA launched the Open Agent Safety Platform on 28 September 2026, introducing OpenShell, an open-source runtime that ensures agents never hold API keys. OpenShell replaces credentials with placeholders, using a proxy to manage access, effectively keeping secrets outside the agent's reach. This marks a shift in how agent security is enforced, providing a robust barrier against unauthorized access.
By the numbers
- 28 September 2026, NVIDIA launched OpenShell
- 403, error code for unauthorized requests
- Apache 2.0, OpenShell's open-source license
What NVIDIA shipped on 28 September, and how it works
28 September 2026 is the date NVIDIA launched the Open Agent Safety Platform, and OpenShell is the open-source runtime, meaning the layer that actually runs the agent and enforces what systems and data it can reach, according to NVIDIA and StackOne. OpenShell provides the runtime layer of that broader platform.
Here is the headline answer: agents should never hold your API keys, and OpenShell enforces that by keeping the real secrets outside the agent.
An API key is a secret string that proves a program is allowed to use a service. A sandbox is a closed room where the agent works, with limits on which files it can touch and which programs it can run.
At launch, OpenShell replaced each credential with an opaque placeholder when the sandbox started. A proxy, which is a service that sits between the agent and the network, then swapped in the real value only for requests to endpoints bound to that credential.
| Model | Where credentials live | What the agent can access |
| Agent-held keys | Inside the agent environment | The real key itself, with whatever the key permits |
| OpenShell external handling | Outside the agent, inserted by a proxy only for approved endpoints | Only placeholders; real secrets never appear inside the agent |
For operators, the practical consequence is blunt. Requests to other hosts fail with a 403, and unresolved placeholders fail closed.
“The agent never sees real credentials.”
Why this release matters when earlier guardrails did not
September 28 is why this stands apart. Nvidia released a free, open-source runtime that puts each agent in its own sandbox and keeps the rules outside the agent’s reach, according to DevFortress.
Earlier agent guardrails usually lived with the agent. OpenShell combines sandboxed execution, controlled service access, credential management, and formal policy analysis outside the workload.
A policy is the written rule for what a request may do. The supervisor checks each request against policy at the binary, destination, method and path levels.
When the agent is tricked, the decision point stays outside its reach.
That changes the failure mode. If an agent goes off task or is manipulated, the request still has to pass an external check before it leaves the sandbox.
The new piece is the policy prover. StackOne reported that OpenShell’s policy prover uses an SMT solver, a program that tests logical constraints, to check what a policy allows instead of relying on someone reading YAML.
What that means in practice
For operators, this is a control plane that does not trust the agent to police itself. The Open Agent Safety Platform continuously monitors and governs agent behavior at launch.
Watch whether teams actually write narrow policies and route requests through this supervisor, because that is where the protection lives.
Who is exposed now, and who gets real cover
OpenShell is free and open source under Apache 2.0, so the cover is available without waiting for a vendor contract. The split now is operational: teams that still hand agents live credentials remain exposed, while teams that put each agent behind OpenShell’s controls get a real barrier.
According to NVIDIA, OpenShell can run fleets of agents in separate sandboxes, each with its own permissions, meaning the specific actions or resources that agent is allowed to use. Flowtivity reported that each agent runs in its own isolated sandbox with no direct network access.
| Role or setup | Exposed now | Less exposed with OpenShell |
| App team putting API keys in prompts, environment variables, or tool configs | Agent can reach or relay secrets if the setup allows it | Secrets stay outside the agent path; access is mediated |
| Team running agents without sandboxing | Agent process has broader reach inside the host | Kernel controls limit which files it can read or change |
| Deployment that lets the agent call arbitrary hosts | Requests can leave for destinations you did not intend | Proxy rejects a placeholder sent to a host outside its binding |
| Org managing many agents across functions | Drift and one-size access spread fast | Per-agent permissions and grouped governance contain blast radius |
The hard loser is any deployment that lets the agent talk directly to the network or the local system. NVIDIA says the sandbox uses operating-system kernel controls to limit file access and block added system privileges.
What this means for you
If you buy, build, or approve agent features, ask one question first: does the agent ever hold the real key. If the answer is yes, you are carrying the risk that OpenShell is designed to remove.
What happens next as OpenShell moves from launch to use
September 28, 2026 is the anchor date. StackOne reported that NVIDIA launched the Open Agent Safety Platform on that day, and the release put OpenShell into the public record as something teams could actually download and test.
The next phase is practical, not rhetorical. OpenShell is free and open source under Apache 2.0, so the immediate work is code review, integration, and deciding whether agents will sit behind the runtime or keep direct access they should not have.
- September 28, 2026: NVIDIA launched the Open Agent Safety Platform, according to StackOne.
- September 28, 2026: DevFortress reported that Nvidia released a free, open-source runtime that puts each AI agent in its own sandbox and keeps the rules outside the agent’s reach.
- At launch: Flowtivity described the release as an open reference design that combines the OpenShell runtime with NVIDIA Sentry and BlueField-4 enforcement.
- After launch: NVIDIA’s technical blog said organizations including Cadence, Slack, and Gecko Robotics are adopting OpenShell for chip design, enterprise automation, and physical robotics governance.
That sequence sets the tests that matter next. First, outside teams will read the code because Apache 2.0 software invites inspection and modification, not just demos.
Second, buyers will watch whether named adopters move from trial language to routine deployment. If teams leave OpenShell as a reference design, the credential claim stays a design pattern; if they put agents behind it, the control becomes operational.
The verdict: agents should not hold your keys
28 September 2026 is the date this stopped being a slogan and became a control. Agents should not hold API keys, and OpenShell lands as the first open runtime that enforces that rule with external credential handling, per-request policy checks, and fail-closed behavior.
Key takeaways
- Reject any agent design that stores real keys in prompts, environment variables, or tool configs. That setup keeps the secret in the agent path.
- Require a runtime where credentials stay outside the sandbox and a proxy injects them only for bound endpoints. If the agent can read the key, the design fails.
- Set a hard rule that arbitrary outbound network access is off. OpenShell’s model blocks direct network access and returns 403s for other hosts.
- Review policies at the binary, destination, method, and path levels. Broad YAML with no external supervisor is not enough.
- Watch deployments, not demos. Count protection as real only when agents run behind separate sandboxes with per-agent permissions.
Sources
- 1. [Agents should never hold your API keys. NVIDIA just open-sourced the runtime that enforces it - DEV Community]( https://dev.to/slabb/agents-should-never-hold-your-api-keys-nvidia-just-open-sourced-the-runtime-that-enforces-it-3jm4)