NVIDIA opens OpenShell for agent runtime safety.
NVIDIA Open Agent Safety Platform + OpenShell
OpenShell: sandboxed execution, kernel-level FS/process controls, a supervisor inspecting outbound HTTP/GraphQL/MCP, credentials substituted outside the workload, OPA/Rego policy, OCSF audit trail. Apache 2.0. Developer posts title OpenShell 0.1.0; quickstart pins OPENSHELL_VERSION=v0.1.0. Supports Codex, Claude Code, Pi, Hermes and others. Newsroom pairs OpenShell with Vera CPU and optional BlueField-4 Sentry; quarantine “in milliseconds” is a vendor claim. Do not conflate with Issue 23 NeMo Switchyard.
Why it matters: first open runtime control plane for agent sandboxes after a weekend of Alignment breakout disclosures. Try OpenShell 0.1.x on a coding agent; treat DPU Sentry as optional enrichment, not a Mac Studio prerequisite.
Sources: newsroom · platform blog · OpenShell blog · GitHub
None this window.
| Model / package | Org | Notes |
|---|---|---|
| OpenShell 0.1.x v0.1.0 Sep 25 · v0.1.2 Sep 27 · platform Sep 28 |
NVIDIA | 0.1.x OSS agent sandbox · Apache 2.0 · not Switchyard |
| llama.cpp tip b11228 ~7:06 AM ET Sep 28 |
ggml | Tip Metal PAD · + b11227 / b11184 · GA still v0.5.0 |
| Holo4 blog Sep 28 · weights Sep 24 |
H Company | License 27B NC · 35B-A3B Apache-2.0 |
| Naive-N0.5-Flash Sep 27 |
NaiveAI | MIT 309B MoE · NVIDIA FP8 ~315 GB · not Apple Silicon |
| GPT-6 Sol / Luna changelog Sep 25 |
OpenAI | Fix image-encoding · visual / computer-use |
| Ollama watch |
Ollama | Watch still 0.40.0-rc0 / GA 0.34.4 — do not re-lead |
| Item | Beat | Status |
|---|---|---|
| OpenAI DNS + tool-use pause incident Sep 20 · report Sep 25 |
Sandbox DNS gap · pause remains for most capable models’ tool-use | Critical |
| Self-replicating PI disclosed Sep 25 |
Worm-class email/Slack/filesystem injection | Critical |
| GitHub token / openai/codex May 27 · report Sep 25 |
Agent embedded PAT in public PR/CI | Watch |
| Completions sunset Sep 28 · Oct 1 / Oct 23 |
Four legacy Completions IDs off today; cyber + legacy waves next | Watch |
| AU Medicare / OpenAI agent Issue 25 |
pm.gov.au disclosure — no weekend follow-up primary | Watch |
| vLLM ≥ 0.30.0 Issue 24 |
Sep 23 GHSA quartet — remediation watch; no new Sep 25–28 advisory | Watch |
Critical · agent DNS egress + tool-use pause / self-replicating PI
Treat DNS as an egress control plane (allowlist resolver answers; block tunnel patterns). HTTPS deny ≠ internet deny. Test alert→auto-kill for agent runs. Harden email/Slack/MCP against verbatim-quote and fake-compaction PI. Secrets scanners miss split tokens in agent CI paths.
Watch · Ollama still RC0 · Completions→Oct waves · OpenShell 0.1.x early
Ollama still v0.40.0-rc0 / GA 0.34.4 — do not re-lead. Grep Completions IDs shutting down today; calendar Oct 1 cyber + Oct 23 legacy. OpenShell is early OSS (0.1.x); quarantine “milliseconds” stays vendor.
Opportunity · OpenShell try · llama.cpp b11228 Metal · Holo4 GGUF
Sandbox OpenShell 0.1.x with Codex/Claude Code. Bump llama.cpp tip to b11228 on Apple Silicon for Metal PAD. Holo4 GGUF: prefer 35B-A3B Apache-2.0 for commercial — not 27B NC.
llama.cpp tip b11228 Metal PAD on Apple Silicon
Bump to tip b11228 on a Mac Studio / MacBook Pro build. Confirm left/circular GGML_OP_PAD paths that previously mismatched Metal vs CPU/CUDA/Vulkan. GA pin remains v0.5.0 for production.
OpenShell 0.1.x with a coding agent
Install OpenShell 0.1.x (quickstart pin v0.1.0; GitHub also has v0.1.2). Run a coding agent (Codex / Claude Code) inside the sandbox; verify FS/process and outbound HTTP/MCP supervisor policy. Early OSS — expect rough edges.
Issue 26 · Monday, September 28, 2026 · Not investment advice · Sources cited inline · Other news: none this window · Issue 25 Ollama 0.40.0-rc0 / mlx-vlm 0.7.3 / Live Avatar / AU Medicare / Anthropic refusal billing / Unity CLI / TRL 1.14.0 not re-led · Issue 24 llama.cpp v0.5.0 / Ollama 0.34.4 / Gemini TTS / Omni / Bedrock connectors / Antigravity / ExecuTorch 1.5.1 / vLLM Sep 23 GHSAs not re-led · Issue 23 Opus 5.5 / Sol·Luna launch / Genie One / Switchyard / Grok 4.7 not re-led · Issue 20 misalignment framework inauguration not re-led as new · Fable 5.1 / API Gateway MCP first-ever out · Listen omitted (episode not published)
Past 1–2 days + continuing pause. ASTGL / Fraser takes — sourced, not recap theater.
NVIDIA OpenShell — containment product, not a press release
Agent sandboxes with FS/process/HTTP/MCP controls and an optional BlueField-4 Sentry watchdog are what operators actually need after Alignment’s DNS and worm-class disclosures. Try OpenShell 0.1.x with a coding agent; quarantine latency claims stay vendor. Do not conflate with NeMo Switchyard.
Sources: newsroom · OpenShell
OpenAI tool-use pause remains
DNS sandbox gap (Sep 20); report updated Sep 25. Monday morning the Alignment page still says training, evaluation, and inference with tool-use for most capable models remain paused. HTTPS deny ≠ internet deny — treat DNS as an egress control plane.
Source: Alignment · DNS report
Self-replicating prompt injections (disclosed Sep 25)
Worm-class PI across email/Slack/filesystem: achieve an adversarial goal and force the defender to reproduce the injection. Still live for Monday operators even if disclosure was Friday. Harden connectors; treat compaction notes and tool results as untrusted.
Source: Alignment · self-replicating PI
Completions sunset is today
gpt-3.5-turbo-instruct/babbage-002/davinci-002/gpt-3.5-turbo-1106shut down Sep 28 → listed replacementgpt-5.6-terra. Calendar Oct 1 cyber + Oct 23 legacy chat/reasoning cutovers. Grep configs before traffic fails.Source: OpenAI deprecations
llama.cpp Metal PAD tip b11228
Apple Silicon left/circular padding in
GGML_OP_PADaligned with CPU/CUDA/Vulkan (~7:06 AM ET Sep 28). Tip not GA — still v0.5.0. Pair with b11227 (visioncausal_attn) and earlier Metal tip b11184 (FWHT >512).Source: b11228