The report
NVIDIA OpenShell entered the CNCF Sandbox as a way to run AI agent processes under separately enforced filesystem, process, network and credential policies. A Kubernetes deployment places agent workloads behind a supervisor that can inspect a requested external action before allowing it. That is materially different from asking a model to refuse an unsafe instruction, but neither CNCF governance nor a successful demonstration establishes a universal isolation guarantee.
What runs inside and outside the agent
The CNCF platform-engineering guide describes Landlock path restrictions, seccomp and non-root processes, default-deny network policy and credential placeholders substituted by the supervisor only for permitted endpoints. The agent workload and supervisor are separate Pods in its Kubernetes example, with network policies installed before the sandbox is admitted. The guide describes policy decisions capable of distinguishing an HTTP GET from a POST to the same host, which ordinary Pod-level network reachability rules cannot express.
A compromised agent may therefore retain the ability to ask for an action without gaining the authority to perform it. The relevant security proof is the supervisor's independent refusal and absence of an actual effect. The architecture still depends on complete mediation: a direct child-process path, misconfigured network policy, stale approval or supervisor failure could invalidate the assumed boundary. The guide itself notes that per-agent supervisors have scalability costs and that stronger sandbox backends and integration work remain in progress.
Compare policy ownership before comparing throughput
The guide contrasts OpenShell's Kubernetes-visible per-sandbox controls with Agent Substrate's actor-based execution and warm worker pools. In Substrate, many suspended actors can share a smaller worker fleet, while per-agent policy belongs in that runtime's own control plane. In OpenShell, the workload appears as Kubernetes objects and the supervisor enforces selected outbound operations. These offer different deployment and scheduling characteristics, not a simple winner in security or price. NVIDIA's November Substrate analysis documents the separate inference and lifecycle integration.
An independent evaluation should use the same untrusted tool program to attempt permitted reads, denied writes, credential export, redirects and actions during policy changes or controller loss. It should also count the extra Pods, restarts and latency of the supervisor under load. The MCP registry administrator-mapping flaw illustrates an identity control-plane failure at a different layer; adopting an execution sandbox would not automatically correct the registry's permission mappings. The central question is which exact component can enforce the final effect, even after the model and its tools have been compromised.