Revision History

Update: added an official video.

Auto-saved before update

Update: link NVIDIA Sentry to its new article.

Verification fixes: Sentry availability note, unlinked missing Hacker News slug

Update: repository state as of 25 October 2026 (v0.1.3 to v0.1.5 releases with a 0.1.x release table, stars, forks, contributors), CNCF onboarding progress, OpenWorker v0.3.x OpenShell integration, ServiceNow Arc general availability, Windows MXC status, Hacker News reception, and a link to the new NVIDIA OpenShell Reference Architecture page

Update: add NVIDIA's 13 Oct 2026 $250M UK agentic safety compute donation (BOLD, SOFAIR, Imperial; research using OpenShell and Sentry) and Perplexity's Escaping SPACE result that neither network-policy bypass worked against OpenShell; link SPACE

Improve internal links (2026-10-13)

Update: OpenWorker merged an optional OpenShell sandbox provider on 24 September 2026 (pinned to 0.0.116, not yet in a tagged release)

Correction: RFC 0012 was described as "accepted on 10 September" but its front matter still says review (its PR was merged 10 Sep); refs 5 and 6 pointed at architecture/ files deleted from main on 29 Sep (repointed to pinned commits). Update: repo stats to 30 Sep, v0.1.2 still latest, CNCF Sandbox vote passed 26 Sep, maintainers/governance, RFC process, Hugging Face egress usage monitoring draft RFC (Hugo Larcher fork, not upstream), OpenClaw Enterprise OpenShell driver (work in progress), OpenAI absence per TechCrunch.

Update: link NVIDIA Agent Toolkit page

Correction: verifier fixes (seccomp/eBPF/Landlock phrase was The New Stack narration, not a Golshan quote; 0.1 requires Landlock; prover framing; Boitano remarks from a press briefing; RFC 0012 dates; OCSF schema version; pinned moved references; advisor-only guidance fields; ServiceNow Project Arc announced not deployed)

Correction: Russell Bryant misidentified as an NVIDIA maintainer (GitHub lists Red Hat); OWASP LLM01 is Prompt Injection, not Indirect Prompt Injection; LangChain release did not say Deep Agents would run in OpenShell sandboxes; 'NeMo Agent Toolkit' corrected to NVIDIA Agent Toolkit; issue #1868 is a PR; host-wildcard rule, Firecracker startup figure, Daytona open-source status, gVisor and sandbox-runtime rows corrected; unsourced 'project lead' and six-month quote attribution fixed. Update: OpenShell 0.1.0/0.1.2 (Sep 2026), alpha label removed, RFC 0012 supervisor-outside-workload redesign, privacy router/inference.local removed, standalone prover, install and HA changes, closed issues #899/#981, Open Agent Safety Platform (Vera, Sentry/BlueField-4, partner integrations), Windows MXC, stars 8,960 (28 Sep 2026).

No summary provided