From the NVIDIA edition of September 30, 2026
Noma Security: OpenShell outer-loop helps, but policy drift and semantic gaps remain
Noma Security · AI security vendor / agent runtime security · Global (enterprise agent security perspective)
- Publisher
- Noma Security Blog
- Original publication
- 2026-09-29T00:00:00Z
- Source retrieved
- 2026-10-01
- Event date
- 2026-09-28
What happened
Sep 29, 2026 Noma Security blog (Gal Moyal) endorses NVIDIA Open Agent Safety’s outer-loop model and details OpenShell controls (filesystem/syscall, L4/L7 including MCP, credential masking, Z3 prover/advisor, gRPC middleware). Material additions beyond prior Sep 28–29 coverage: it states Sentry is a reference architecture and NVIDIA has not announced general availability; it warns sandbox policies drift toward over-permissive wildcards; and it lists semantic gaps—indirect prompt injection, uninspected WebSocket server-to-client streams, tool responses inspected only if middleware is configured, and coverage holes for desktop/IDE/SaaS agents outside OpenShell. Content is partly promotional for Noma’s complementary controls.
Why it matters
Useful residual-risk checklist for campus/agency OpenShell pilots: do not treat launch-week Sentry messaging as GA hardware enforcement, and budget for policy lifecycle plus semantic inspection beyond YAML sandboxes.
Evidence and measured results
Opened Noma blog dated September 29, 2026. Body includes two-layer summary, explicit Sentry reference-architecture/not-GA statement, policy-drift and semantic-threat sections, and Noma product positioning.
Limitations and uncertainty
Security vendor with commercial interest in extending OpenShell; not an independent lab audit; no SLED measured deny/quarantine deployments.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-01; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Security stakeholders need an operational residual-risk list beyond launch-day silicon messaging.
- Stakeholders
- CISO
- AI platform
- app-sec
- procurement
- Discovery questions
- Which agents run in OpenShell vs SaaS/IDE?
- Who reviews wildcard policies?
- Is Sentry in scope before GA?
- Value hypothesis
- Checklist of OpenShell gaps supports honest OpenShell-first pilot scoping.
- Potential engagement
- Risk workshop producing OpenShell residual register and phase-1 scope.
- Unsupported claims
- Sentry GA
- Complete semantic coverage from sandbox alone
- Independent audit in this blog
Pre-sales engineering
Role takeaway
- Fit
- Fit for OpenShell pilots that must document semantic and coverage gaps.
- Architecture and integration
- OpenShell + middleware inspection; Sentry optional later; separate controls for SaaS agents.
- Prerequisites
- OpenShell 0.1.x
- policy store
- middleware hooks
- agent inventory
- Constraints
- Sentry reference-not-GA
- WebSocket gaps
- policy drift
- vendor promotional bias
- Security
- Boundary controls do not equal semantic safety or DLP.
- Proof of value
- Injection red-team
- Wildcard-policy review
- Tool-response inspection test
Delivery
Role takeaway
- Work
- Operate OpenShell with scheduled policy reviews and an explicit residual-risk memo.
- Dependencies
- App-sec
- AI platform
- SOC
- IdP
- Ownership
- Platform security with AI platform engineering.
- Skills and adoption
- Train reviewers to catch over-permissive directories/domains and MCP rules.
- Governance checkpoints
- Policy CAB
- Residual-risk acceptance
- Sentry GA watch item
- Acceptance criteria
- Deny-test evidence
- Middleware coverage confirmed
- Out-of-sandbox agent list
- Risks
- Assuming all agents are sandboxed
- Buying BlueField solely on reference design messaging
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
OpenShell covers container/microVM CLI and homegrown agents; expect separate controls for SaaS/IDE agents; Sentry path remains BlueField reference, not broadly GA.
Governance
Who approves, reviews and stays accountable for outcomes?
Policy authoring/review must fight wildcard drift; middleware hooks become mandatory for tool-response inspection.
Security and privacy
What data, permissions and controls need testing?
Boundary enforcement alone misses in-scope semantic abuse and some payload paths (WebSocket); credential masking helps but does not replace DLP/identity controls.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Residual-risk registers should be readable by research leads who are not kernel/DPU specialists.
Procurement
What should contracts, pricing and exit terms secure?
Do not procure BlueField solely on Sentry reference-design language; require GA status and validation plans.
Operating model
Which teams own the service once it runs?
OpenShell-first with semantic/middleware add-ons is the realistic near-term operating model for mixed agent fleets.
Publication history
- 2026-09-30NVIDIA · Issue 255 resources
Stable resource ID: noma-openshell-residual-risks-20260929