From the NVIDIA edition of October 2, 2026
Anomity: OpenShell security-team guide—audit-mode defaults, Landlock best_effort, inventory gap
Anomity Research · AI agent security / independent analysis · Global (U.S.-facing vendor security blog)
- Publisher
- Anomity
- Original publication
- 2026-10-02T00:00:00Z
- Source retrieved
- 2026-10-03
- Event date
- 2026-10-02
What happened
Oct 2, 2026 Anomity Research guide for security teams deploying NVIDIA OpenShell (Apache 2.0 Rust runtime; stable 0.1.0 Sep 25 / 0.1.2 Sep 28) states the architecture is strong—supervisor outside the agent holds credentials, fail-closed freeze if supervisor disconnects, Landlock/seccomp/egress-proxy/provider layers—but several defaults favor adoption over enforcement: HTTP rules default to audit (log then forward), Landlock compatibility defaults to best_effort, OCSF JSON export is off until enabled, and anonymous telemetry is on. The policy prover covers filesystem/process/Landlock/network/REST and reports GraphQL/MCP policies as uncheckable rather than silently passing. OpenShell governs only agents started inside it; it does not discover native laptop agents.
Why it matters
Translates Open Agent Safety launch claims into concrete production hardening checklist for campus/agency agent sandboxes—audit→enforce cutover, Landlock hard_requirement, SIEM export, and inventory denominator—without assuming BlueField-4 Sentry.
Evidence and measured results
Opened Anomity article with schema.org datePublished 2026-10-02. Body documents defaults table (audit enforcement, best_effort Landlock, OCSF off, telemetry on), four enforcement layers, prover coverage limits, and explicit non-coverage of agents outside the sandbox.
Limitations and uncertainty
Vendor-complementary security blog with Anomity product positioning; not a SLED red-team report; defaults guidance is interpretive of NVIDIA docs rather than agency measured outcomes.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-03; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Buyers adopting OpenShell after launch coverage need a hardening checklist for defaults that favor first-run convenience.
- Stakeholders
- CISO
- AI platform lead
- SOC/IR
- procurement
- Discovery questions
- Will you run OpenShell in audit or enforce on day one?
- Do you have an inventory of agents not started inside OpenShell?
- Is OCSF export to SIEM a go-live gate?
- Value hypothesis
- Independent defaults guide can bound a software-first OpenShell pilot and surface residual inventory/telemetry gaps without selling Sentry hardware.
- Potential engagement
- Security architecture workshop mapping enforce cutover, Landlock mode, credential providers, and inventory denominator.
- Unsupported claims
- Guaranteed SLED deny/quarantine outcomes
- Published OpenShell p50/p99 overhead
- Sentry GA price and ship date
Pre-sales engineering
Role takeaway
- Fit
- Software-first OpenShell on Linux hosts with gateway/supervisor; Sentry optional.
- Architecture and integration
- Supervisor mediates credentials and egress; sandbox holds no secrets; Landlock/seccomp/OPA proxy layers.
- Prerequisites
- Linux 6.2+ with Landlock ABI 3
- Docker 28 / Podman 5
- Policy-as-code and SIEM collectors
- Constraints
- Defaults are audit/best_effort until changed
- Prover does not model GraphQL/MCP
- No discovery of native agents
- Security
- Fail-closed freeze if supervisor disconnects; pin binary SHA-256 on network rules; disable telemetry if policy requires.
- Proof of value
- Audit→enforce cutover with zero unexpected blocks on allowlist
- Supervisor-disconnect freeze drill
- Prover CI fails on exit ≠ 0
Delivery
Role takeaway
- Work
- Hardening runbook: override defaults, enable OCSF, wire CI prover, inventory outside agents.
- Dependencies
- InfoSec policy owners
- Endpoint management
- Identity/credential vault
- AI platform SRE
- Ownership
- CISO-sponsored platform team owns runtime; SOC owns OCSF detections.
- Skills and adoption
- Train operators on rule approve/advisor flow and durable terminal approvals.
- Governance checkpoints
- Default-override sign-off
- SIEM OCSF ingestion check
- Inventory coverage review
- Acceptance criteria
- Enforce mode on production REST endpoints
- hard_requirement Landlock where kernel supports
- CI gate pass-only-on-exit-0
- Risks
- False confidence from audit defaults
- Shadow agents outside sandbox
- Policy drift via terminal approvals
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Design software-first OpenShell on existing Linux hosts with gateway/supervisor credential brokering; treat Sentry/BlueField-4 as optional second tier. Force enforce mode and hard_requirement Landlock before calling the boundary production.
Governance
Who approves, reviews and stays accountable for outcomes?
Require documented default overrides, CI policy-prover gates (exit 0 only), and agent-inventory coverage metrics in any OpenShell RFP—not just runtime install counts.
Security and privacy
What data, permissions and controls need testing?
Audit-mode defaults and best_effort Landlock can create a false sense of containment; OCSF must be explicitly enabled for SIEM; telemetry opt-out needed for privacy-sensitive SLED fleets.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
OpenShell skills and CLI require platform/security staffing; accessibility of agent tooling for non-engineering faculty/staff is out of scope of this guide.
Procurement
What should contracts, pricing and exit terms secure?
RFPs should list required default overrides and inventory metrics; Apache license does not equal production acceptance criteria.
Operating model
Which teams own the service once it runs?
Treat sandbox enrollment rate against total agent inventory as an operating KPI, not install count alone.
Publication history
- 2026-10-02NVIDIA · Issue 286 resources
Stable resource ID: anomity-openshell-defaults-20261002