{"resourceId":"anomity-openshell-defaults-20261002","versions":[{"version":"external-a64b9a51c62c4e825e31f4fdf80e8fc8fd81688fe4d3191322dd0b7554d409e6","resource":{"id":"anomity-openshell-defaults-20261002","title":"Anomity: OpenShell security-team guide—audit-mode defaults, Landlock best_effort, inventory gap","organization":"Anomity Research","sector":"AI agent security / independent analysis","geography":"Global (U.S.-facing vendor security blog)","publishedAt":"2026-10-02T00:00:00Z","publicationDate":"2026-10-02","eventDate":"2026-10-02","sourceName":"Anomity","sourceLabel":"Independent security operating guide / day-after OpenShell scrutiny","sourceUrl":"https://anomity.ai/blog/nvidia-openshell-agent-sandbox-security-guide/","evidenceClass":"independent-reporting","outcomeClass":"cautionary","topics":["developers-agents","data-security","governance-procurement","operating-model","infrastructure"],"finding":"Oct 2, 2026 Anomity Research guide for security teams deploying NVIDIA OpenShell (Apache 2.0 Rust runtime; stable 0.1.0 Sep 25 / 0.1.2 Sep 28) states the architecture is strong—supervisor outside the agent holds credentials, fail-closed freeze if supervisor disconnects, Landlock/seccomp/egress-proxy/provider layers—but several defaults favor adoption over enforcement: HTTP rules default to audit (log then forward), Landlock compatibility defaults to best_effort, OCSF JSON export is off until enabled, and anonymous telemetry is on. The policy prover covers filesystem/process/Landlock/network/REST and reports GraphQL/MCP policies as uncheckable rather than silently passing. OpenShell governs only agents started inside it; it does not discover native laptop agents.","sledRelevance":"Translates Open Agent Safety launch claims into concrete production hardening checklist for campus/agency agent sandboxes—audit→enforce cutover, Landlock hard_requirement, SIEM export, and inventory denominator—without assuming BlueField-4 Sentry.","evidence":"Opened Anomity article with schema.org datePublished 2026-10-02. Body documents defaults table (audit enforcement, best_effort Landlock, OCSF off, telemetry on), four enforcement layers, prover coverage limits, and explicit non-coverage of agents outside the sandbox.","architectureImplications":"Design software-first OpenShell on existing Linux hosts with gateway/supervisor credential brokering; treat Sentry/BlueField-4 as optional second tier. Force enforce mode and hard_requirement Landlock before calling the boundary production.","governanceImplications":"Require documented default overrides, CI policy-prover gates (exit 0 only), and agent-inventory coverage metrics in any OpenShell RFP—not just runtime install counts.","securityPrivacyImplications":"Audit-mode defaults and best_effort Landlock can create a false sense of containment; OCSF must be explicitly enabled for SIEM; telemetry opt-out needed for privacy-sensitive SLED fleets.","caveats":"Vendor-complementary security blog with Anomity product positioning; not a SLED red-team report; defaults guidance is interpretive of NVIDIA docs rather than agency measured outcomes.","streamIds":["nvidia"],"roles":{"sales":"Open with production defaults, not launch features: Anomity’s Oct 2 OpenShell guide says HTTP rules start in audit, Landlock is best_effort, OCSF export is off, and telemetry is on—so a default install is not a hardened boundary. Use for CISO/AI-platform discovery after Sep 28–Oct 1 Open Agent Safety coverage. Ask whether they will mandate enforce mode, hard_requirement Landlock, and an agent inventory denominator. Unsupported here: SLED measured deny rates, published OpenShell overhead, or BlueField-4 Sentry GA price/ship date.","engineering":"Fit for designing campus/agency coding-agent sandboxes on Linux (Landlock ABI 3 / kernel 6.2+). Integrate OpenShell gateway + supervisor with credentials outside the sandbox; pin binary digests on network rules. Prerequisites: Docker/Podman, policy-as-code skill, SIEM path for OCSF. Constraints: GraphQL/MCP policies uncheckable by prover; filesystem changes need sandbox recreate; no discovery of native agents. Proof: cutover drill auditing then enforcing, and fail closed when supervisor disconnects.","delivery":"Work: pilot OpenShell with documented default overrides, OCSF to SIEM, and inventory of agents still outside the sandbox. Dependencies: InfoSec, desktop/endpoint, identity, AI platform. Ownership: CISO with platform engineering. Skills: policy YAML, prover CI, Landlock. Governance: change-control for terminal approvals that widen sandbox life. Acceptance: enforce-mode on production endpoints, hard_requirement Landlock, exit-0-only CI. Risks: equating Apache availability with production-ready defaults."},"roleDetails":{"sales":{"customerProblem":"Buyers adopting OpenShell after launch coverage need a hardening checklist for defaults that favor first-run convenience.","stakeholders":["CISO","AI platform lead","SOC/IR","procurement"],"discoveryQuestions":["Will you run OpenShell in audit or enforce on day one?","Do you have an inventory of agents not started inside OpenShell?","Is OCSF export to SIEM a go-live gate?"],"valueHypothesis":"Independent defaults guide can bound a software-first OpenShell pilot and surface residual inventory/telemetry gaps without selling Sentry hardware.","potentialEngagement":"Security architecture workshop mapping enforce cutover, Landlock mode, credential providers, and inventory denominator.","unsupportedClaims":["Guaranteed SLED deny/quarantine outcomes","Published OpenShell p50/p99 overhead","Sentry GA price and ship date"]},"engineering":{"fit":"Software-first OpenShell on Linux hosts with gateway/supervisor; Sentry optional.","architectureIntegration":"Supervisor mediates credentials and egress; sandbox holds no secrets; Landlock/seccomp/OPA proxy layers.","prerequisites":["Linux 6.2+ with Landlock ABI 3","Docker 28 / Podman 5","Policy-as-code and SIEM collectors"],"constraints":["Defaults are audit/best_effort until changed","Prover does not model GraphQL/MCP","No discovery of native agents"],"security":"Fail-closed freeze if supervisor disconnects; pin binary SHA-256 on network rules; disable telemetry if policy requires.","proofOfValue":["Audit→enforce cutover with zero unexpected blocks on allowlist","Supervisor-disconnect freeze drill","Prover CI fails on exit ≠ 0"]},"delivery":{"work":"Hardening runbook: override defaults, enable OCSF, wire CI prover, inventory outside agents.","dependencies":["InfoSec policy owners","Endpoint management","Identity/credential vault","AI platform SRE"],"ownership":"CISO-sponsored platform team owns runtime; SOC owns OCSF detections.","skillsAdoption":"Train operators on rule approve/advisor flow and durable terminal approvals.","governanceCheckpoints":["Default-override sign-off","SIEM OCSF ingestion check","Inventory coverage review"],"acceptanceCriteria":["Enforce mode on production REST endpoints","hard_requirement Landlock where kernel supports","CI gate pass-only-on-exit-0"],"risks":["False confidence from audit defaults","Shadow agents outside sandbox","Policy drift via terminal approvals"]}},"retrievedAt":"2026-10-03T03:05:00Z","enrichedAt":"2026-10-03T03:05:19Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"OpenShell skills and CLI require platform/security staffing; accessibility of agent tooling for non-engineering faculty/staff is out of scope of this guide.","procurementImplications":"RFPs should list required default overrides and inventory metrics; Apache license does not equal production acceptance criteria.","operatingModelImplications":"Treat sandbox enrollment rate against total agent inventory as an operating KPI, not install count alone.","sourceVerification":{"openedUrl":"https://anomity.ai/blog/nvidia-openshell-agent-sandbox-security-guide/","referenceExcerpt":"Several defaults favor getting started over enforcement: HTTP rules run in audit mode","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}