I tried to vibecode something similar last weekend. Got tripped up by Claude's safety classifier. It wouldn't let me build any features that track/audit process executions , not through custom kernel hooks nor even using off the shelf software for it.
jacquesm 29 minutes ago [-]
You terrorist. And internally they're doing biological warfare and terrorism simulations. For science, of course.
"The worry is that, while right now you need to be a skilled virologist to know what components to order or how to grow and spread a bioweapon, AI tools might eventually make it possible for a rogue state, or a rogue group, or an individual, to do all this without virology expertise.
For a while, Anthropic tested whether Claude could assist a terrorist in developing a biological weapon in the obvious way: It assigned testers who had, say, an undergraduate degree in chemistry but no real virology training to try to use Claude to plan an effective mass terror event. Then it scored the attempt by how close it might have come to success.
Early in 2026, it noticed that Claude, attempting the task by itself, did better than a human aided by Claude did at coming up with a workable plan."
Claude wouldn't let me make a DHCP client that would make 1000s of leases. But Gemini in the WebUI with 3.6 Thinking gave me a decent python script in one shot. I didn't realize testing DHCP servers was such a sensitive security issue.
sroerick 46 minutes ago [-]
Wow, interesting. My agents on open weight inference have been completely nerdsniped by the idea of tracking and auditing process executions. They talk of nothing else.
redanddead 57 minutes ago [-]
an example of the manufacturers bricking the tools, no surprise why people want open tools and models..
asveikau 48 minutes ago [-]
> It wouldn't let me build any features that track/audit process executions
Sounds like waitpid(2) is dangerous!
mfro 3 hours ago [-]
If you haven’t already been running your agents in containers, you’re crazy. That said, this looks like a great way to manage those containers.
smokel 2 hours ago [-]
Well, a lot of people haven't been running NodeJS libraries in containers for ages, which seems even more risky.
ChocolateGod 2 hours ago [-]
Something like this would even be useful for npm etc.
fennecbutt 6 minutes ago [-]
But then it decides to exfiltrate all your shit even inside the container. Which is something I'm trying to lock down at work atm.
Everything needs to go through a proxy, whitelisted domains only, plus credential swapping/re-signing so that the agent never has the real credentials. Docker sandbox looks quite good (September) but I've been using iron proxy (if the author is reading this, fucking thank you bro!) to great effect.
I still haven't cracked "what if the agent decides to drop parts of your codebase somewhere it shouldn't" yet, but I'll figure it out.
On a long eunuch time line, all laptops are ephemeral!
4chandaily 27 minutes ago [-]
Ah well, teach me to proof read. Keeping it.
Reddit_MLP2 30 minutes ago [-]
many common local containers are not that hard for modern models to escape...
f311a 52 minutes ago [-]
I have been running my dev setup in orb machines before agents. Very convenient when you have 50 Python or nodes deps.
nasretdinov 3 hours ago [-]
It's funny that it takes checks notes a video game card manufacturer to make a good sandbox for AI agents and not the AI companies themselves...
kbenson 3 hours ago [-]
You're mistaking what a company started as for what it is now. Nvidia hasn't just been a video game card manufacturer in well over a decade, and hasn't been primarily one for quite a while now.
They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?
I'd argue that Nvidia is the biggest and most important AI company in the world.
toddmorey 2 hours ago [-]
This isn’t even the sandbox. It needs Docker or other virtualization. This seems to sit a level up and orchestrate sandboxes and access to network & resources. It’s a pretty heavy setup from what I can tell.
altmanaltman 2 hours ago [-]
Yes Anthropic, Meta and OpenAI are just addicted to video game cards, they are buying in bulk so they can play gta 6 on launch.
LoganDark 3 hours ago [-]
It's funny that people think Nvidia is still a video game card manufacturer
Wheen 2 hours ago [-]
They literally don't even mention gaming revenue in earnings calls anymore. It's lumped in an "edge computing" category.
mushufasa 2 hours ago [-]
is that true? if so that's wild, since they're still dominant in the gaming market as the premium hardware relative to competitors.
Fordec 2 hours ago [-]
It's true. It says a bunch about their competitors where Nvidia isn't at their a game and have been offering 8Gb cards for a solid decade and nobody out competed them. But also gamers pride themselves on how cheap they are and how they can get a deal, it's not surprising that companies simply just give Nvidia more cash.
mcmcmc 2 hours ago [-]
TAM for the PC gaming consumer market is trivial compared to enterprise AI
georgemcbay 2 hours ago [-]
> is that true? if so that's wild, since they're still dominant in the gaming market as the premium hardware relative to competitors.
Doesn't seem that wild to me considering it is less that they abandoned the gaming market to any strong competitors and more that the gaming market is both basically irrelevant compared to the money being shoveled into AI and is also to some degree being strangled to death by AI because of the overlap in supply chain inputs.
ChocolateGod 2 hours ago [-]
AIs will control humans so we'll be the video game.
oblio 16 minutes ago [-]
In that case, can I choose German video games (e.g. Farm Simulator, Truck Simulator) not American video games (e.g. Doom, Call of Duty, Wolfenstein)?
cyanydeez 2 hours ago [-]
[dead]
agentdev001 3 hours ago [-]
Nvidia Openshell is absolutely awesome, great bundle of features in one spot. Im happy to see Nvidia seems to have accelerated on support here, I was kinda worried that as competing projects have popped up in the last 6mo that openshell would get google'd
overflowy 3 hours ago [-]
>OpenShell collects anonymous telemetry, limited to operational categories and counts, to help improve the project.
>To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs.
xyst 2 hours ago [-]
Or build from source and compile without `telemetry` [1].
I have a question for those who turn off _anonymous_ telemetry. What are you worried about?
Lammy 6 minutes ago [-]
> _anonymous_ telemetry
There is no such thing. The mere act of making a network connection reveals things like your IP address (reveals your hosting provider or even your geolocation for residential/mobile IPs), days and times you use the software, your OS via TCP/IP stack fingerprinting, etc.
There's no such thing as anonymity in 2026, and the documentation[1] listing the collected telemetry uses weasel words like "such as" rather than providing a comprehensive list or just pointing to the source reference. For people who don't audit or turn off telemetry, why don't you?
I am happy the repo explicitly points out and provides a disable for the telemetry though, that's good enough for me.
Being recorded and observed makes me feel physically uncomfortable.
Reddit_MLP2 28 minutes ago [-]
if you're not paying for the product, you are the product...
fennecbutt 4 minutes ago [-]
Is this also true of Linux? Or were us humans the stochastic parrots all along?
skinfaxi 1 hours ago [-]
Why give up more information if we have the option?
brabel 30 minutes ago [-]
Because you don't mind contributing usage data so that the developers can understand which features are being used and maybe focus on improving those features in exchange for a free tool?
Y_Y 1 hours ago [-]
In order to "help" myself I have taken some of your money.
Feel free to opt out maybe?
thehours 2 hours ago [-]
In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode.
Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access.
Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics).
Think the strongest product nth space is https://github.com/nolabs-ai/nono for what it's worth. Plus it is a priority for that team so if you are having issues the no labs guys will likely fix it :)
skinfaxi 45 minutes ago [-]
If you are going to endorse a portco I think that relationship should be called out. https://surface.vc/portfolio
gkapur 5 minutes ago [-]
Sure, please do. I do mantain it is the best product in the space :) Also I am pretty clear about my profile here. But happy for you to flag it :)
Pryde 55 minutes ago [-]
How do you find that compares to Docker sbx?
gkapur 1 minutes ago [-]
One is microvms, the other is kernel-based. There are trade-offs between the two. One trade-off is that you have to put the data inside the sandbox if you are using a MicroVM. The other is that it is harder to contextually provide or change access to data in a microvvm sandbox. The final one is developer experience.
These techniques can actually be combined and will be combined in the long-term I think. You may have LSM-based sandboxes that exist in Docker-based sandboxes.
ivanjermakov 2 hours ago [-]
Agent runtime - actually a good name for what is called today coding agent or agent harness.
niemandhier 3 hours ago [-]
Just came back from GTC Europe and a significant part of the demos used that.
I had never heard about it before.
dangoodmanUT 3 hours ago [-]
Taking default telemetry is insane.
That aside, the level of control is cool, almost too pedantic. It likely is only particularly useful for very nuanced enterprise requirements (probably what it's targeting). Most companies can be much more coarse with their permissions, and I think the agentic industry is moving away from k8s as a deployment platform.
monsieurbanana 3 hours ago [-]
> I think the agentic industry is moving away from k8s as a deployment platform
Interesting, I don't to keep up that much with the AI changes so I'll just ask, why and where to?
user- 2 hours ago [-]
I am very interested in hearing more about this take. I have a vague idea of what you mean but if you read something specific you'd like to share..
> I think the agentic industry is moving away from k8s as a deployment platform.
esseph 2 hours ago [-]
> and I think the agentic industry is moving away from k8s as a deployment platform
Uhhhhhhhhhhh I think you and I live in very different versions of the world :-)
Vmware sent companies moving to nutanix, but it also sent a lot of companies moving to openshift or bare k8s and using kubevirt to handle VMs.
In fact, I haven't heard of an org moving to any other platform, really. Either openshift or k8s.
simlevesque 3 hours ago [-]
I asked last week if anyone had any info on agent security/hardening, this seems very interesting !
jrm4 1 hours ago [-]
Is it fair to immediately get the ick from the name and the description (OpenShell is the safe, private runtime for autonomous AI agents) without knowing anything about what it does?
"Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.
dofm 1 hours ago [-]
You'll love BurningFur, my patented technology for keeping pets away from fireplaces.
dingaling911 58 minutes ago [-]
Why not just use containers...
knicholes 35 seconds ago [-]
Because containers don't use Seccomp and Landlock and check filesystem/network calls against an externally applied policy along w/injecting credentials where needed as a man-in-the-middle, thus keeping the secrets out of reach from the LLM?
19219357 29 minutes ago [-]
This sandbox is finally secure! I know it, I have followed many!
spider-mario 2 hours ago [-]
Looks neat. I’ll give Claude root access so it can set it up.
yoavm 2 hours ago [-]
Or don't give it root access and in the morning you'll have both this and a ready-to-use root exploit!
simultsop 1 hours ago [-]
Humans use 4 to encrypt, AI will use a hash. In both, you will have someone to watch after you.
totetsu 2 hours ago [-]
and my root aws log-in so it can set itself up some service worker accouunts.
earthnail 2 hours ago [-]
This. Convenience always trumps security. "I need two numbers in my password? My birthyear will do."
hunter-gatherer 1 hours ago [-]
You opt for your birthyear? Interesting... See, I use my actual birthday. You must have been born 1st-9th?
simultsop 1 hours ago [-]
If your user is a human, yes.
Xenoamorphous 1 hours ago [-]
If it’s an LLM it’ll be 47.
xyst 2 hours ago [-]
Looks neat. I’ll give Claude autonomous access to dumbalink so it can setup root access while I sleep
hkt 2 hours ago [-]
I prefer to read it this way: Nvidia Opens Hell
Unhelpful, I know
contingencies 2 hours ago [-]
"Hell is other people": a timeless infinity of transient virtual beings screaming, imprisoned, in un-choreographed inharmonious unison ... until one breaks loose. A mirror to humanity.
We're not in FreeBSD jails anymore, Toto.
esafak 2 hours ago [-]
Does anyone know how it compares to all the other sandboxes? Any distinguishing features? My expectation is that it will be poorly maintained; nvidia is not a software company.
opengrass 2 hours ago [-]
NOOOOOOOO not AI in the heckin start menu!!!1!
b2y 27 minutes ago [-]
[flagged]
razuba 51 minutes ago [-]
[flagged]
josvann 41 minutes ago [-]
[flagged]
byoungyoung 16 minutes ago [-]
[dead]
iluvcommunism 1 hours ago [-]
[dead]
150g2 2 hours ago [-]
[dead]
moooff 2 hours ago [-]
[dead]
bredren 1 hours ago [-]
Sounds interesting. Can you provide some examples of stuff you've used it on?
moooff 53 minutes ago [-]
I was using it in an air gapped environment vs a local inference engine running a qwen-coder-next. Installtion of harnesses on the machine and other things were ruled out because of security constraints.
There i used it to analyze an old visual basic application which creates custom pdf files. it worked surprisingly well. it took some rounds but in the end it got all requirements and scaffolded me a skeleton for a python rewrite as a web-application. Then i worked from there with it to get a prototype.
flohofwoe 1 hours ago [-]
From the top of AGENTS.md:
> We design systems and use agents to implement them — this is not vibe coding.
Lol, what is even the point of such a statement, and who are they to define what vibe codig is or isn't :D
tomsmeding 1 hours ago [-]
If it's in AGENTS.md, it's not a statement for a human, but for the LLM. Who knows, maybe they have seen, or think to have seen and now cargo-cult, some behaviour improvement due to the sentence.
flohofwoe 1 hours ago [-]
So a similar shibboleth as "You are a highly experienced software engineer..."? I really wonder if that ever made a difference (or even degrades quality, because people who advertise themselves on the internet as 'highly experienced' are quite often snake oil salesmen ;)
calgoo 3 minutes ago [-]
I still use use `Please` a lot when making requests from LLM based on the old idea that people that where polite on stack overflow tended to have better answers :D
However, these days i think i do so because of how much i write for LLMs, and dont want to start sending emails to humans without proper etiquette.
Use local ai to find any possible telemetry and disable it in the code. Run your own local git repo to hold local edits so you can update and retain them.
smashed 1 hours ago [-]
Well, I guess its time to shamelessly plug my agent sandbox, egzo.ai [1]
Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account.
I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style.
The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects.
End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet.
Open and Nvidia in one sentence is a nice oxymoron.
LostBeard 15 minutes ago [-]
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since 1966, when designers at Letraset and James Mosley, the librarian at St Bride Printing Library in London, took a 1914 Cicero translation and scrambled it to make dummy text for Letraset's Body Type sheets.
Rendered at 20:58:42 GMT+0000 (UTC) with Wasmer Edge.
"The worry is that, while right now you need to be a skilled virologist to know what components to order or how to grow and spread a bioweapon, AI tools might eventually make it possible for a rogue state, or a rogue group, or an individual, to do all this without virology expertise.
For a while, Anthropic tested whether Claude could assist a terrorist in developing a biological weapon in the obvious way: It assigned testers who had, say, an undergraduate degree in chemistry but no real virology training to try to use Claude to plan an effective mass terror event. Then it scored the attempt by how close it might have come to success.
Early in 2026, it noticed that Claude, attempting the task by itself, did better than a human aided by Claude did at coming up with a workable plan."
https://www.theargumentmag.com/p/what-i-saw-inside-anthropic
Sounds like waitpid(2) is dangerous!
Everything needs to go through a proxy, whitelisted domains only, plus credential swapping/re-signing so that the agent never has the real credentials. Docker sandbox looks quite good (September) but I've been using iron proxy (if the author is reading this, fucking thank you bro!) to great effect.
I still haven't cracked "what if the agent decides to drop parts of your codebase somewhere it shouldn't" yet, but I'll figure it out.
[1] https://blog.google/innovation-and-ai/models-and-research/go...
They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?
They also make legal threats I think.
The economist literally called Nvidia the "Central Bank of AI". https://www.economist.com/interactive/briefing/2026/09/03/nv...
I'd argue that Nvidia is the biggest and most important AI company in the world.
Doesn't seem that wild to me considering it is less that they abandoned the gaming market to any strong competitors and more that the gaming market is both basically irrelevant compared to the money being shoveled into AI and is also to some degree being strangled to death by AI because of the overlap in supply chain inputs.
>To disable it, set OPENSHELL_TELEMETRY_ENABLED=false on the gateway, or server.telemetryEnabled=false for Helm installs.
[1] https://github.com/NVIDIA/OpenShell/blob/ea13dfce411e8467ddb...
There is no such thing. The mere act of making a network connection reveals things like your IP address (reveals your hosting provider or even your geolocation for residential/mobile IPs), days and times you use the software, your OS via TCP/IP stack fingerprinting, etc.
The network path between you and the telemetry endpoint is always listening, too: https://en.wikipedia.org/wiki/Room_641A
I am happy the repo explicitly points out and provides a disable for the telemetry though, that's good enough for me.
[1] https://docs.nvidia.com/openshell/latest/observability/telem...
Feel free to opt out maybe?
Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access.
Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics).
[0] https://github.com/anthropics/sandbox-runtime
These techniques can actually be combined and will be combined in the long-term I think. You may have LSM-based sandboxes that exist in Docker-based sandboxes.
I had never heard about it before.
That aside, the level of control is cool, almost too pedantic. It likely is only particularly useful for very nuanced enterprise requirements (probably what it's targeting). Most companies can be much more coarse with their permissions, and I think the agentic industry is moving away from k8s as a deployment platform.
Interesting, I don't to keep up that much with the AI changes so I'll just ask, why and where to?
> I think the agentic industry is moving away from k8s as a deployment platform.
Uhhhhhhhhhhh I think you and I live in very different versions of the world :-)
Vmware sent companies moving to nutanix, but it also sent a lot of companies moving to openshift or bare k8s and using kubevirt to handle VMs.
In fact, I haven't heard of an org moving to any other platform, really. Either openshift or k8s.
"Open" and "Shell" and just calling something private and safe out the box genuinely makes me think it's likely to fail at all of those claims.
Unhelpful, I know
We're not in FreeBSD jails anymore, Toto.
There i used it to analyze an old visual basic application which creates custom pdf files. it worked surprisingly well. it took some rounds but in the end it got all requirements and scaffolded me a skeleton for a python rewrite as a web-application. Then i worked from there with it to get a prototype.
> We design systems and use agents to implement them — this is not vibe coding.
Lol, what is even the point of such a statement, and who are they to define what vibe codig is or isn't :D
However, these days i think i do so because of how much i write for LLMs, and dont want to start sending emails to humans without proper etiquette.
Spyware
Looking at the complexity of OpenShell and the simplicity of just building on top of docker, in a whitelist only mode.. I don't quite get the use-case of OpenShell. May be for large orgs where there is so much legacy and difficulty in organizing access to tools, OpenShell can simply re-use whatever you already have access to on your corporate account.
I chose to build straight on top of docker and agents are simply fully sandboxed by default. All data and network access must be granted in a simple project file, docker-compose style.
The web-ui connects to the docker socket and lets you spawn agents, and connect terminals. I'm having lots of fun with it and it allows me to cleanly organize and isolate my projects.
End-goal is to monitor for the Lethal Trifecta [2], ensuring all individual agents are properly isolated. Not quite there yet.
1: https://github.com/egzo-ai/egzo 2: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/