{"resourceId":"vast-nvidia-agent-sandbox-foundation-stack-20261021","versions":[{"version":"external-8577ef66bdee1e4e2125bf294d18168086b593f5141a3161e531ce61921b7266","resource":{"id":"vast-nvidia-agent-sandbox-foundation-stack-20261021","title":"VAST Data announces an Agent Sandbox Foundation Stack with NVIDIA NemoClaw and OpenShell, claiming persistent agent state and durable audit records","organization":"VAST Data with NVIDIA","sector":"Vendor platform (cross-sector; applicable to public-sector agent deployments)","geography":"Global (announced New York and NVIDIA GTC Berlin)","publishedAt":"2026-10-21","publicationDate":"2026-10-21","eventDate":"2026-10-21","sourceName":"VAST Data","sourceLabel":"VAST Data press release","sourceUrl":"https://www.vastdata.com/press-releases/vast-data-nvidia-secure-ai-agent-sandbox-infrastructure","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","infrastructure","data-security","governance-procurement"],"finding":"VAST announced a Foundation Stack in which NVIDIA OpenShell provides isolated execution and policy enforcement, while the VAST AI OS supplies zero-copy-clone sandbox workspaces (DataStore), shared agent memory/context (DataBase), and a persistent record of agent tool calls, prompts, tokens, costs and decisions, plus VAST Management System observability. VAST says it will demo at GTC Berlin and publish an automated deployment on GitHub. No customer deployment, benchmark or independent validation is cited.","sledRelevance":"Limited but timely: state agencies and universities piloting agentic AI need audit trails and data persistence that survive ephemeral agent compute. The announcement is a vendor architecture, not a SLED deployment; relevance is as a design option to evaluate against public-records, audit and security requirements.","evidence":"Vendor press release only (vendor claim). Capabilities are described, not measured. Independent scrutiny of the underlying NVIDIA runtime: Lasso Security (April 2026, this edition) showed policy-permitted exfiltration through default egress, and an independent test already archived on this site (dev.to, Oct 23, 2026) reported OpenShell 0.1.5's documented OCSF audit export produced zero records in two runs.","architectureImplications":"Decouples agent state from compute: sandboxes are provisioned via zero-copy clones and snapshots; agent memory and activity logs sit in VAST DataBase. This concentrates agent state, context and audit records on one data platform, which helps continuity but raises lock-in and blast-radius questions.","governanceImplications":"A durable agent-activity record could support public-records, audit and incident-review obligations, but only if completeness is verified; independent testing of the runtime layer shows enforcement and evidence capture can diverge.","securityPrivacyImplications":"Persisted prompts and tool-call logs may contain sensitive or regulated data and require retention, access control and redaction policies. Sandbox isolation does not prevent misuse of policy-permitted egress (Lasso findings).","caveats":"Single vendor source with partner quotes; no performance, scale or customer data. GitHub deployment was described as planned. Page date label shows Oct 20 while the dateline is October 21, 2026 (dateline used). Independent findings concern NVIDIA OpenShell, not VAST components; NVIDIA runtime coverage belongs primarily to the NVIDIA stream and is cross-referenced here only because it underpins this stack.","streamIds":["vast-data"],"roles":{"sales":"The selling point is accountability for agents, not speed: VAST claims agent state and a full activity record persist after sandboxes disappear. That maps to agency and university concerns about records retention and post-incident review for agentic pilots. Keep it bounded: this is a vendor announcement with no customer or measured results, and independent testing of the NVIDIA runtime found evidence gaps. Lead discovery with audit and records questions, and offer a validation pilot rather than promising compliance.","engineering":"Engineering should evaluate this as a reference architecture: OpenShell enforces policy, while VAST holds workspaces via zero-copy clones, agent memory in DataBase and activity logs. The key question is whether the VAST-side record is complete when the runtime's own export can be empty, as an independent test reported. Prototype with the promised GitHub deployment, reconcile logged actions against ground truth, test egress policies against supply-chain attacks, and check how prompts and secrets are stored and redacted.","delivery":"Delivery teams would own a new operational surface: agent workspaces, snapshots, persistent memory and audit logs that must be retained, secured and reviewed. Before any public-sector pilot, define retention schedules, records-request handling, access roles and incident procedures for agent logs. Plan reconciliation testing between runtime events and stored records as a gating step. Because this is newly announced vendor capability, budget time for version changes and for coordination between VAST, NVIDIA and the customer's security office."},"roleDetails":{"sales":{"customerProblem":"Public-sector agent pilots need persistent state and a defensible record of what agents did, beyond ephemeral sandbox compute.","stakeholders":["Agency CIO/CISO","Records management officer","University research IT or AI program lead","Internal audit"],"discoveryQuestions":["What records-retention rules apply to agent prompts and tool calls?","How do you verify an agent action log is complete today?","Which agent runtimes and sandboxes are you piloting?"],"valueHypothesis":"If its records prove complete under testing, a persistent agent-activity store could reduce effort to reconstruct agent actions for audits; this is unproven.","potentialEngagement":"A bounded proof-of-concept that deploys the published stack in a lab and reconciles recorded agent actions against independent ground truth.","unsupportedClaims":["Compliance with any records or security mandate","Production readiness or scale (thousands of agents) in public-sector environments","Protection against policy-permitted exfiltration"]},"engineering":{"fit":"Fits organizations already standardizing on NVIDIA agent runtimes and VAST storage; weak fit where agent runtimes are heterogeneous.","architectureIntegration":"NVIDIA NemoClaw/OpenShell runtime above VAST DataStore (sandbox storage, snapshots), VAST DataBase (memory, context, activity records) and VAST Management System.","prerequisites":["VAST AI OS cluster","NVIDIA NemoClaw/OpenShell deployment","Defined egress and data-access policies","Log retention and redaction policy"],"constraints":["Vendor-described capability without independent validation","Runtime audit export reported empty in an independent test of OpenShell 0.1.5","Coupling of agent state to one data platform"],"security":"Stored prompts, tokens and tool calls may hold sensitive data; sandbox isolation does not stop misuse of allowed egress, so egress policy and credential handling must be tested independently.","proofOfValue":["Reconcile stored activity records against independent ground truth for planted actions","Red-team default egress paths (npm, git/gh)","Measure workspace provisioning time with zero-copy clones"]},"delivery":{"work":"Operate agent workspaces, snapshots and audit records, including retention, access control and incident review.","dependencies":["VAST and NVIDIA release cadence","Customer security office approval","Records management schedules"],"ownership":"Customer platform engineering team with CISO oversight for audit records.","skillsAdoption":"Staff need agent-runtime policy authoring, log reconciliation and records-management skills, not just storage administration.","governanceCheckpoints":["Security review of egress policy before pilot","Records-retention approval for agent logs","Post-pilot audit of log completeness"],"acceptanceCriteria":["Proposed: 100% of planted test actions appear in stored records","Proposed: retention and redaction rules applied to prompt logs","Proposed: documented incident-reconstruction drill completed"],"risks":["Incomplete audit evidence","Sensitive data accumulation in prompt logs","Vendor lock-in of agent state"]}},"retrievedAt":"2026-10-29T22:06:10-05:00","enrichedAt":"2026-10-29T22:13:03-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Introduces new workforce skills (agent policy, log review); no direct accessibility content in the source.","procurementImplications":"Buyers should require independent validation and log-completeness testing in contracts rather than relying on announced capabilities; the stack spans two vendors' support boundaries.","operatingModelImplications":"Persistent agent state shifts responsibility for agent memory and records to the data platform team.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://www.vastdata.com/press-releases/vast-data-nvidia-secure-ai-agent-sandbox-infrastructure","referenceExcerpt":"VAST DataBase maintains a persistent record of agent activity, including tool calls, prompts, tokens, costs and decisions.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}