{"resourceId":"noma-openshell-residual-risks-20260929","versions":[{"version":"external-f0dfcff083870d2d3bf277a0f379ad3612a60c61b571f689515c289eabd83766","resource":{"id":"noma-openshell-residual-risks-20260929","title":"Noma Security: OpenShell outer-loop helps, but policy drift and semantic gaps remain","organization":"Noma Security","sector":"AI security vendor / agent runtime security","geography":"Global (enterprise agent security perspective)","publishedAt":"2026-09-29T00:00:00Z","publicationDate":"2026-09-29","eventDate":"2026-09-28","sourceName":"Noma Security Blog","sourceLabel":"Security vendor technical commentary (complementary product)","sourceUrl":"https://noma.security/blog/beyond-the-sandbox-securing-nvidias-open-agent-safety-platform","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["developers-agents","data-security","governance-procurement","operating-model"],"finding":"Sep 29, 2026 Noma Security blog (Gal Moyal) endorses NVIDIA Open Agent Safety’s outer-loop model and details OpenShell controls (filesystem/syscall, L4/L7 including MCP, credential masking, Z3 prover/advisor, gRPC middleware). Material additions beyond prior Sep 28–29 coverage: it states Sentry is a reference architecture and NVIDIA has not announced general availability; it warns sandbox policies drift toward over-permissive wildcards; and it lists semantic gaps—indirect prompt injection, uninspected WebSocket server-to-client streams, tool responses inspected only if middleware is configured, and coverage holes for desktop/IDE/SaaS agents outside OpenShell. Content is partly promotional for Noma’s complementary controls.","sledRelevance":"Useful residual-risk checklist for campus/agency OpenShell pilots: do not treat launch-week Sentry messaging as GA hardware enforcement, and budget for policy lifecycle plus semantic inspection beyond YAML sandboxes.","evidence":"Opened Noma blog dated September 29, 2026. Body includes two-layer summary, explicit Sentry reference-architecture/not-GA statement, policy-drift and semantic-threat sections, and Noma product positioning.","architectureImplications":"OpenShell covers container/microVM CLI and homegrown agents; expect separate controls for SaaS/IDE agents; Sentry path remains BlueField reference, not broadly GA.","governanceImplications":"Policy authoring/review must fight wildcard drift; middleware hooks become mandatory for tool-response inspection.","securityPrivacyImplications":"Boundary enforcement alone misses in-scope semantic abuse and some payload paths (WebSocket); credential masking helps but does not replace DLP/identity controls.","caveats":"Security vendor with commercial interest in extending OpenShell; not an independent lab audit; no SLED measured deny/quarantine deployments.","streamIds":["nvidia"],"roles":{"sales":"Open with ecosystem residual risks after the Sep 28 launch week: Noma’s Sep 29 note—while promotional—states Sentry is still a reference architecture without announced GA and catalogs OpenShell gaps (policy wildcards, prompt injection, uninspected WebSockets, agents outside the sandbox). Use for CISO conversations that already absorbed Futurum/Tech Insider scrutiny and need operational checklist detail. Discovery: which agent classes are in-scope for OpenShell, and who owns policy drift reviews. Unsupported: that Noma (or Sentry) closes semantic risk completely, or that BlueField Sentry is generally available.","engineering":"Fit when designing an OpenShell-first pilot with explicit non-goals. Integrate OpenShell deny-by-default plus middleware inspection for tool responses; treat Sentry as optional future reference path. Prerequisites: agent inventory (CLI vs SaaS/IDE), policy reviewers, logging. Constraints: Sentry not GA per this source; WebSocket/tool-response gaps; over-permissive policies defeat sandbox. Proof: red-team prompt injection and wildcard-policy cases; confirm middleware inspects tool responses.","delivery":"Work: publish an OpenShell residual-risk register and policy-review cadence; defer Sentry until GA/hardware path exists. Dependencies: AI platform, app-sec, SOC, IdP. Ownership: platform security. Skills: policy lifecycle and agent threat modeling. Governance: change control for wildcard exceptions. Acceptance: documented deny tests + residual sign-off. Risks: equating partner blogs with independent audits or assuming all enterprise agents sit in OpenShell."},"roleDetails":{"sales":{"customerProblem":"Security stakeholders need an operational residual-risk list beyond launch-day silicon messaging.","stakeholders":["CISO","AI platform","app-sec","procurement"],"discoveryQuestions":["Which agents run in OpenShell vs SaaS/IDE?","Who reviews wildcard policies?","Is Sentry in scope before GA?"],"valueHypothesis":"Checklist of OpenShell gaps supports honest OpenShell-first pilot scoping.","potentialEngagement":"Risk workshop producing OpenShell residual register and phase-1 scope.","unsupportedClaims":["Sentry GA","Complete semantic coverage from sandbox alone","Independent audit in this blog"]},"engineering":{"fit":"Fit for OpenShell pilots that must document semantic and coverage gaps.","architectureIntegration":"OpenShell + middleware inspection; Sentry optional later; separate controls for SaaS agents.","prerequisites":["OpenShell 0.1.x","policy store","middleware hooks","agent inventory"],"constraints":["Sentry reference-not-GA","WebSocket gaps","policy drift","vendor promotional bias"],"security":"Boundary controls do not equal semantic safety or DLP.","proofOfValue":["Injection red-team","Wildcard-policy review","Tool-response inspection test"]},"delivery":{"work":"Operate OpenShell with scheduled policy reviews and an explicit residual-risk memo.","dependencies":["App-sec","AI platform","SOC","IdP"],"ownership":"Platform security with AI platform engineering.","skillsAdoption":"Train reviewers to catch over-permissive directories/domains and MCP rules.","governanceCheckpoints":["Policy CAB","Residual-risk acceptance","Sentry GA watch item"],"acceptanceCriteria":["Deny-test evidence","Middleware coverage confirmed","Out-of-sandbox agent list"],"risks":["Assuming all agents are sandboxed","Buying BlueField solely on reference design messaging"]}},"retrievedAt":"2026-10-01T03:03:22Z","enrichedAt":"2026-10-01T03:07:50Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Residual-risk registers should be readable by research leads who are not kernel/DPU specialists.","procurementImplications":"Do not procure BlueField solely on Sentry reference-design language; require GA status and validation plans.","operatingModelImplications":"OpenShell-first with semantic/middleware add-ons is the realistic near-term operating model for mixed agent fleets.","sourceVerification":{"openedUrl":"https://noma.security/blog/beyond-the-sandbox-securing-nvidias-open-agent-safety-platform","referenceExcerpt":"Sentry is a reference architecture; NVIDIA has not announced general availability","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}