{"resourceId":"aigenapps-openshell-source-audit-defaults-20261023","versions":[{"version":"external-2b5695e6d7c6d3ec839d6cac5bd1318f71861d3cfc0cc0cb97f6aebd3d038535","resource":{"id":"aigenapps-openshell-source-audit-defaults-20261023","title":"We audited OpenShell's source. The design holds and the defaults do not.","organization":"AI Gen Apps (independent engineering review)","sector":"Agent runtime security: independent source-code review","geography":"Global (software review)","publishedAt":"AI Gen Apps engineering paper, Oct. 23, 2026","publicationDate":"2026-10-23","eventDate":"2026-10-23","sourceName":"AI Gen Apps","sourceLabel":"NVIDIA OpenShell: a source code audit","sourceUrl":"https://aigenapps.com/papers/engineering/nvidia-openshell-source-audit","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["data-security","developers-agents","governance-procurement"],"finding":"A source-code review of NVIDIA OpenShell, the agent sandbox Red Hat says it is integrating into Red Hat AI, was read at commit bc4c8f0 on Oct. 23, 2026. It finds that enforcement outside the agent process is real and fails closed at startup. Several defaults are permissive: L7 request rules default to audit (log and forward) unless enforcement is set; endpoints without a protocol field get no method or path rules; the user filesystem policy defaults to best effort; binary allow rules also authorize descendant processes; credentials are substituted outbound but responses are not scrubbed. On Kubernetes, egress isolation depends on the cluster network plugin enforcing NetworkPolicy. The review also cites an NVIDIA bulletin of Aug. 25 listing six OpenShell vulnerabilities, two rated 9.9, fixed in 0.0.34.","sledRelevance":"Directly relevant to any state, local or university team evaluating Red Hat AI agent hosting on OpenShift. The controls Red Hat markets for agent safety only work as advertised when configured explicitly. The audit's checklist (enforce mode, hard filesystem requirement, manual approval, NetworkPolicy-enforcing CNI) can become procurement and acceptance requirements.","evidence":"Read the full audit page. The method is code and documentation reading at a fixed commit; the authors state they did not build or run OpenShell. Findings are labeled as either read in code paths or stated in project documentation. No exploit testing or benchmark was performed. The vulnerability list is reported from NVIDIA's bulletin as summarized by the authors; the bulletin itself was not opened for this edition.","architectureImplications":"On OpenShift, agent sandbox isolation depends on the cluster's network plugin enforcing NetworkPolicy and on user namespaces, which the audit says are off by default. Architects should treat the sandbox as one layer beneath tenant authorization and audit, not as the authorization layer.","governanceImplications":"Policy changes should be reviewed manually; the audit warns that operators can switch approval to automatic, and that the formal prover is not what gates approvals. It recommends running the containment checker against a written boundary policy in CI.","securityPrivacyImplications":"Exfiltration paths remain through any allowed endpoint, and real credentials can reach the agent if an approved API reflects them in responses. Request bodies are not inspected by default.","caveats":"Code reading only, no runtime testing. Snapshot of a fast-moving project. Published by a company that sells AI products and services. Reviews NVIDIA's upstream code, not a Red Hat-packaged build.","streamIds":["red-hat"],"roles":{"sales":"Sales framing: use this as a credibility tool, not an objection to hide. An independent review says the OpenShell design behind Red Hat's agent-safety pitch holds up, but its defaults do not. SLED buyers with skeptical CISOs will respond better to a team that brings the hardening checklist than to one claiming secure by default. Position a configuration-hardening and validation service with any agent-hosting pilot, and do not promise that sandboxing alone prevents data exfiltration.","engineering":"Engineering framing: the audit is effectively a hardening baseline. Set enforcement to enforce and give every API endpoint a protocol. Require the hard filesystem requirement, keep approval mode manual and keep authorized binaries out of writable paths. Prove the OpenShift CNI enforces NetworkPolicy. Run the containment checker in CI against a boundary policy. The sandbox does not scrub credentials from responses, so tenant authorization and data-loss controls still have to live above it.","delivery":"Delivery framing: build the audit's priority list into the runbook and acceptance tests for any agent environment. Assign an owner for sandbox policy versions and re-review after each OpenShell release, given the pace of change. Include negative tests (blocked writes, blocked egress, no credential reflection) in go-live criteria. Track the upstream security bulletins and the Red Hat-packaged version separately. Budget time for this in every release cycle."},"roleDetails":{"sales":{"customerProblem":"Security leaders need assurance that agent sandboxes actually block unauthorized actions before approving agent pilots.","stakeholders":["CISO / security architecture","Platform engineering","Internal audit","Agency AI governance board"],"discoveryQuestions":["Who will own and review agent sandbox policies?","Does your Kubernetes network plugin enforce NetworkPolicy today?","What evidence does your security review need before an agent gets credentials?"],"valueHypothesis":"A documented hardening baseline and validation tests can shorten security review for agent pilots compared with reviewing each agent from scratch.","potentialEngagement":"Agent sandbox hardening assessment and validation test suite for one pilot environment.","unsupportedClaims":["That OpenShell defaults are secure out of the box","That sandboxing prevents all data exfiltration","That findings apply unchanged to future Red Hat-packaged releases"]},"engineering":{"fit":"Applies wherever OpenShell is used or planned as the agent runtime on OpenShift or Podman.","architectureIntegration":"Sandbox policy files under version control, containment checker in CI, NetworkPolicy-enforcing CNI, and tenant authorization in a gateway above the sandbox.","prerequisites":["OpenShell 0.0.34 or later (0.1 series current per the audit)","CNI with NetworkPolicy enforcement","Policy repository and CI pipeline"],"constraints":["Findings are a code-reading snapshot","Kubernetes user namespaces off by default","No response scrubbing of credentials"],"security":"Set enforce mode, hard filesystem requirement and manual approval. Prefer exact hosts and specific tool binaries. Treat every allowed endpoint as an exfiltration path.","proofOfValue":["Attempt a write against a read-only rule and confirm it is blocked, not just logged","Confirm sandbox pods cannot bypass policy on the customer's CNI","Confirm an approved API echoing a header does not expose a real credential in the test scenario"]},"delivery":{"work":"Write and maintain hardened sandbox policies, CI containment checks and negative acceptance tests for agent environments.","dependencies":["Upstream OpenShell release cadence","Red Hat packaging timeline","Security team test approval"],"ownership":"Platform engineering owns policies; the CISO office approves changes.","skillsAdoption":"Policy-as-code and Kubernetes network-policy training for platform staff.","governanceCheckpoints":["Policy review before each agent onboarding","Re-review after each OpenShell version change","Monthly review of audit-mode logs"],"acceptanceCriteria":["Proposed: zero endpoints left in audit mode at go-live","Proposed: containment check passes in CI for every policy change","Proposed: all negative egress tests blocked"],"risks":["Silent audit-mode policies","Policy drift as the project changes quickly","Over-reliance on the sandbox in place of authorization"]}},"retrievedAt":"2026-10-30T03:11:07Z","enrichedAt":"2026-10-30T03:21:15Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Secure configuration requires policy-as-code expertise that many SLED IT teams lack, which argues for templates and training.","procurementImplications":"Solicitations for agent platforms can require documented enforce-mode defaults, CNI NetworkPolicy validation and minimum patched versions rather than accepting 'sandboxed' as a checkbox.","operatingModelImplications":"The project moves fast (the audit cites roughly eight commits a day), so findings can date within weeks. Platform owners need a recurring review cadence.","sourceVerification":{"openedUrl":"https://aigenapps.com/papers/engineering/nvidia-openshell-source-audit","referenceExcerpt":"Request rules default to logging rather than blocking, credentials are guarded on the way out but not on the way back","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}