From the VAST Data edition of October 29, 2026
VAST Data announces an Agent Sandbox Foundation Stack with NVIDIA NemoClaw and OpenShell, claiming persistent agent state and durable audit records
VAST Data with NVIDIA · Vendor platform (cross-sector; applicable to public-sector agent deployments) · Global (announced New York and NVIDIA GTC Berlin)
- Publisher
- VAST Data
- Original publication
- 2026-10-21
- Source retrieved
- 2026-10-30
- Event date
- 2026-10-21
What happened
VAST announced a Foundation Stack in which NVIDIA OpenShell provides isolated execution and policy enforcement, while the VAST AI OS supplies zero-copy-clone sandbox workspaces (DataStore), shared agent memory/context (DataBase), and a persistent record of agent tool calls, prompts, tokens, costs and decisions, plus VAST Management System observability. VAST says it will demo at GTC Berlin and publish an automated deployment on GitHub. No customer deployment, benchmark or independent validation is cited.
Why it matters
Limited but timely: state agencies and universities piloting agentic AI need audit trails and data persistence that survive ephemeral agent compute. The announcement is a vendor architecture, not a SLED deployment; relevance is as a design option to evaluate against public-records, audit and security requirements.
Evidence and measured results
Vendor press release only (vendor claim). Capabilities are described, not measured. Independent scrutiny of the underlying NVIDIA runtime: Lasso Security (April 2026, this edition) showed policy-permitted exfiltration through default egress, and an independent test already archived on this site (dev.to, Oct 23, 2026) reported OpenShell 0.1.5's documented OCSF audit export produced zero records in two runs.
Limitations and uncertainty
Single vendor source with partner quotes; no performance, scale or customer data. GitHub deployment was described as planned. Page date label shows Oct 20 while the dateline is October 21, 2026 (dateline used). Independent findings concern NVIDIA OpenShell, not VAST components; NVIDIA runtime coverage belongs primarily to the NVIDIA stream and is cross-referenced here only because it underpins this stack.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-29; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public-sector agent pilots need persistent state and a defensible record of what agents did, beyond ephemeral sandbox compute.
- Stakeholders
- Agency CIO/CISO
- Records management officer
- University research IT or AI program lead
- Internal audit
- Discovery questions
- What records-retention rules apply to agent prompts and tool calls?
- How do you verify an agent action log is complete today?
- Which agent runtimes and sandboxes are you piloting?
- Value hypothesis
- If its records prove complete under testing, a persistent agent-activity store could reduce effort to reconstruct agent actions for audits; this is unproven.
- Potential engagement
- A bounded proof-of-concept that deploys the published stack in a lab and reconciles recorded agent actions against independent ground truth.
- Unsupported claims
- Compliance with any records or security mandate
- Production readiness or scale (thousands of agents) in public-sector environments
- Protection against policy-permitted exfiltration
Pre-sales engineering
Role takeaway
- Fit
- Fits organizations already standardizing on NVIDIA agent runtimes and VAST storage; weak fit where agent runtimes are heterogeneous.
- Architecture and integration
- NVIDIA NemoClaw/OpenShell runtime above VAST DataStore (sandbox storage, snapshots), VAST DataBase (memory, context, activity records) and VAST Management System.
- Prerequisites
- VAST AI OS cluster
- NVIDIA NemoClaw/OpenShell deployment
- Defined egress and data-access policies
- Log retention and redaction policy
- Constraints
- Vendor-described capability without independent validation
- Runtime audit export reported empty in an independent test of OpenShell 0.1.5
- Coupling of agent state to one data platform
- Security
- Stored prompts, tokens and tool calls may hold sensitive data; sandbox isolation does not stop misuse of allowed egress, so egress policy and credential handling must be tested independently.
- Proof of value
- Reconcile stored activity records against independent ground truth for planted actions
- Red-team default egress paths (npm, git/gh)
- Measure workspace provisioning time with zero-copy clones
Delivery
Role takeaway
- Work
- Operate agent workspaces, snapshots and audit records, including retention, access control and incident review.
- Dependencies
- VAST and NVIDIA release cadence
- Customer security office approval
- Records management schedules
- Ownership
- Customer platform engineering team with CISO oversight for audit records.
- Skills and adoption
- Staff need agent-runtime policy authoring, log reconciliation and records-management skills, not just storage administration.
- Governance checkpoints
- Security review of egress policy before pilot
- Records-retention approval for agent logs
- Post-pilot audit of log completeness
- Acceptance criteria
- Proposed: 100% of planted test actions appear in stored records
- Proposed: retention and redaction rules applied to prompt logs
- Proposed: documented incident-reconstruction drill completed
- Risks
- Incomplete audit evidence
- Sensitive data accumulation in prompt logs
- Vendor lock-in of agent state
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Decouples agent state from compute: sandboxes are provisioned via zero-copy clones and snapshots; agent memory and activity logs sit in VAST DataBase. This concentrates agent state, context and audit records on one data platform, which helps continuity but raises lock-in and blast-radius questions.
Governance
Who approves, reviews and stays accountable for outcomes?
A durable agent-activity record could support public-records, audit and incident-review obligations, but only if completeness is verified; independent testing of the runtime layer shows enforcement and evidence capture can diverge.
Security and privacy
What data, permissions and controls need testing?
Persisted prompts and tool-call logs may contain sensitive or regulated data and require retention, access control and redaction policies. Sandbox isolation does not prevent misuse of policy-permitted egress (Lasso findings).
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Introduces new workforce skills (agent policy, log review); no direct accessibility content in the source.
Procurement
What should contracts, pricing and exit terms secure?
Buyers should require independent validation and log-completeness testing in contracts rather than relying on announced capabilities; the stack spans two vendors' support boundaries.
Operating model
Which teams own the service once it runs?
Persistent agent state shifts responsibility for agent memory and records to the data platform team.
Publication history
- 2026-10-29VAST Data · Issue 014 resources
Stable resource ID: vast-nvidia-agent-sandbox-foundation-stack-20261021