With OpenShell, NVIDIA shifts the boundary of agent safety. Not requests written into prompts, but limits enforced by the runtime: that distinction is at the core of the announcement shared by Jensen Huang, which describes an open source sandbox built for local and open agents. More than one hundred companies have joined the safety stack. OpenAI does not appear in that group.

The gap between the two approaches is technical before it is commercial. A prompt rule is a linguistic constraint: the model can ignore it, lose it in long contexts, or be overwritten by an injection. A runtime limit operates below the model, at the layer that manages execution: it can prevent an agent from writing outside a directory, restrict network connections, or stop a process attempting unplanned operations. For those running agents on their own infrastructure, this kind of control matters because there is no central API to delegate policy to. The sandbox becomes the point where the constraint is applied deterministically.

This is not an academic distinction. A local agent acting on files, databases, or enterprise systems needs verifiable boundaries. Prompt instructions can reduce the likelihood of unwanted behavior, but they do not provide an execution guarantee. An open source sandbox adopted by a wide group of organizations creates a common reference for audit, integration, and maintenance. It also shifts the cost of safety from prompt engineering quality to the robustness of isolation: if the runtime is the new perimeter, the most critical attacks become sandbox escapes, not only text manipulation.

OpenAI's decision not to join signals a different path. For providers offering closed models and access mainly through the cloud, agent governance can be handled inside the platform, with proprietary controls and centralized visibility. NVIDIA's project instead appears to build a safety layer for those who want or need to keep agents within their own perimeter: organizations with data sovereignty requirements, air-gapped environments, self-hosted infrastructure.

In this view, OpenShell is not just a component to integrate. It is an indication of how the local agent market is seeking its own standards, separate from the safety mechanisms of cloud providers. Security no longer depends only on what the model agrees to do, but on what the execution environment materially allows it to do. For those evaluating on-premise deployments, the trade-offs between local control and operational burden can be measured through the analytical frameworks collected in AI-RADAR's /llm-onpremise section.