{"resourceId":"nvidia-openshell-issue-2050-mxc-windows-driver-lossy-policy-translation-20260629","versions":[{"version":"external-ecba71cc96628c69ba45225f1fc2e223ce842decc5f401620a8438a55ce3da15","resource":{"id":"nvidia-openshell-issue-2050-mxc-windows-driver-lossy-policy-translation-20260629","title":"NVIDIA OpenShell RFC #2050: the Windows MXC driver translates OpenShell policy lossily (64 access-broadening errors across five example policies) and MXC host filtering is not yet enforced on Windows","organization":"NVIDIA (OpenShell open-source project)","sector":"Technology vendor (open-source agent sandbox)","geography":"Global","publishedAt":"2026-06-29T19:39:47Z","publicationDate":"2026-06-29","eventDate":"2026-10-07","sourceName":"GitHub — NVIDIA/OpenShell issues","sourceLabel":"Project design RFC (self-disclosed limitations)","sourceUrl":"https://github.com/NVIDIA/OpenShell/issues/2050","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["developers-agents","data-security"],"finding":"An NVIDIA engineer's RFC (opened June 29, 2026, still open) designs OpenShell's native Windows support on MXC. Rather than porting OpenShell's Linux in-sandbox enforcer, it moves egress and L7 policy to a host proxy and uses MXC as a coarse kernel-level allowlist. It reports that across five OpenShell example policies every generated MXC config was schema-valid but lossy, with 64 access-broadening errors, 32 warnings and 4 info items; MXC cannot express port, protocol, per-binary or L7 rules. Its risk table says MXC allowedHosts/blockedHosts were not enforced on Windows, OCSF audit loses in-process events, credentials briefly appear in process arguments, and MXC defaults to allow when the network block is omitted.","sledRelevance":"Why now: on Oct 7 Microsoft made MXC generally available and said NVIDIA has integrated OpenShell into it. Public-sector security teams evaluating that combination should know, from NVIDIA's own design record, that on Windows the fine-grained OpenShell policies they may have reviewed on Linux are enforced by a host proxy, not by the OS container, and that audit coverage is narrower.","evidence":"Opened the GitHub issue page and the issue body and comments via the GitHub API (two comments: an RFC-number assignment and a stale-bot notice). Design analysis by the project, not a test of the shipped GA release.","architectureImplications":"Windows deployment is three parts: the OpenShell gateway, a Windows-only MXC driver in-process, and Microsoft's wxc-exec binary, with no OpenShell code inside the sandbox. Rich policy depends on the host CONNECT proxy correctly attributing each loopback connection to its sandbox.","governanceImplications":"Policy approvals made for Linux OpenShell deployments do not transfer one-to-one to Windows; reviewers should require the mapper's loss report for each policy.","securityPrivacyImplications":"No kernel-level defense-in-depth beneath the host proxy for host filtering on Windows per the RFC; reduced OCSF visibility; credentials passed in argv; MXC's default-allow when network policy is omitted means hand-written MXC configs must set block explicitly.","caveats":"Design RFC dated June 29, 2026; the GA release may have changed some items (for example host-filter enforcement). Not an independent test. The issue was marked stale in July with no later activity visible.","streamIds":["nvidia"],"roles":{"sales":"This RFC lets us set honest expectations with security-minded public-sector buyers: NVIDIA's own engineers document that OpenShell on Windows enforces its detailed policies through a host proxy, with the OS container as a coarser layer. That supports a credible message: we help validate what is enforced where. We can offer a policy-fidelity review. We should not tell customers OpenShell on Windows gives Linux-equivalent isolation or full audit; the project says it does not.","engineering":"Technically, the Windows design trades in-sandbox enforcement for a host proxy plus MXC's host/IP-level allowlist. Fit is acceptable for egress-controlled developer agents; weaker for workloads needing per-binary or port-scoped rules at kernel level. Prerequisites are Windows 11 with MXC and the OpenShell gateway as a service. Constraints are lossy translation, attribution of loopback connections and narrower OCSF events. Proof of value: run the mapper on your policy, read the loss report, and test bypass attempts.","delivery":"Delivery teams should add a Windows-specific policy review step: generate the MXC config, inspect the loss report, and confirm the host proxy is the enforcing layer for anything lost. Security engineering owns sign-off. Checkpoints are loss-report review, bypass testing and re-review on each OpenShell or MXC update. Proposed acceptance: no unreviewed access-broadening items remain in production policy. Risks include gateway restarts orphaning sessions and credentials visible in process listings."},"roleDetails":{"sales":{"customerProblem":"Security teams may assume NVIDIA's agent sandbox gives the same guarantees on Windows as on Linux.","stakeholders":["CISO / security architecture","Endpoint engineering","Developer platform lead","Audit or compliance office"],"discoveryQuestions":["Which OpenShell policies have you approved, and on which OS?","Do you rely on OCSF audit events for agent oversight?","Who reviews policy changes when the platform updates?"],"valueHypothesis":"A policy-fidelity review can prevent approving Windows agent pilots on the basis of Linux-only guarantees (interpretation).","potentialEngagement":"A short Windows policy-fidelity review: run the mapper on approved policies, document the loss report and test the host proxy.","unsupportedClaims":["Linux-equivalent isolation on Windows","Complete OCSF audit coverage on Windows","That the June RFC limits are unchanged in the GA release"]},"engineering":{"fit":"Workable for egress-controlled developer agents on Windows; weaker where kernel-enforced per-binary or port rules are required.","architectureIntegration":"OpenShell gateway runs a host CONNECT proxy; MXC process or isolation-session container redirects network to it; policy mapper emits a block-by-default MXC config plus a loss report.","prerequisites":["Windows 11 with MXC","OpenShell gateway deployed as a service","Policy mapper loss report for each policy"],"constraints":["MXC cannot encode ports, protocols, per-binary or L7 rules","Host filtering not enforced by MXC on Windows per the RFC","OCSF events limited to network and lifecycle","Single-session limit for isolation_session"],"security":"Treat the host proxy as the enforcing layer; set network defaultPolicy to block explicitly; avoid passing credentials in arguments.","proofOfValue":["Compare Linux and Windows enforcement for the same policy","Attempt per-binary and port-scoped bypasses on Windows","Restart the gateway and check for orphaned sessions"]},"delivery":{"work":"Add a Windows-specific OpenShell policy review and bypass test to agent pilot onboarding.","dependencies":["OpenShell and MXC release notes","Security engineering time","Host proxy logging"],"ownership":"Security engineering signs off each Windows agent policy; platform team operates the gateway.","skillsAdoption":"Reviewers learn to read the mapper loss report and test host-proxy enforcement.","governanceCheckpoints":["Loss-report review","Bypass test before production","Re-review on each OpenShell or MXC update"],"acceptanceCriteria":["No unreviewed access-broadening items in production policy (proposed)","Bypass tests fail closed (proposed)"],"risks":["Gateway restart orphaning sessions","Credential exposure in process listings","Design drift between RFC and shipped release"]}},"retrievedAt":"2026-10-08T03:00:16Z","enrichedAt":"2026-10-08T03:09:35Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Requires security staff comfortable with policy-as-code and proxy troubleshooting; smaller IT shops may need outside help.","procurementImplications":"Ask NVIDIA or integrators for the current Windows loss report and the status of each RFC risk item in the GA release before approving deployments.","operatingModelImplications":"Windows agent sandboxing depends on a long-running gateway service, adding an operational component endpoint teams must monitor.","sourceVerification":{"openedUrl":"https://github.com/NVIDIA/OpenShell/issues/2050","referenceExcerpt":"every generated MXC config is schema-valid but lossy: an aggregate of 64 access-broadening errors, 32 warnings, and 4 info items.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}