Unverified50% confidenceFactExact time
OpenShell uses the operating system kernel to confine agents in a sandbox, restricting the files they can access and the processes they can start, and completely blocking their network, with outbound requests checked against policy by a Supervisor outside the sandbox.
1
Sources
50%
Confidence
Long-term
Relevance
10/27/2026
First Seen
Sources
NVIDIA OpenShell: Putting the Brakes on AI Agents
bilibili寰宇智潮9/30/2026
Related Entities
Related Claims
UnverifiedThe core function of Sandbox Runtime is to limit the scope of what AI agents can do: agents cannot access websites that are not explicitly allowed, nor can they read private files (such as SSH keys).71% similarVerifiedSandbox technology confines the execution of untrusted code to a controlled environment through means such as process isolation, file system isolation, and network isolation.70% similarVerifiedA sandbox is a security technology that restricts program execution to an isolated space, with the core idea being the principle of least privilege.70% similarVerifiedOpenClaw carries security risks: because its built-in tools have extremely high permissions (capable of operating system files, reading browser information, and executing tasks online), any configured API Keys are highly susceptible to leakage if the machine is compromised.69% similarUnverifiedBy restricting the agent's system call permissions, network access scope, and filesystem boundaries, sandboxes can confine the blast radius of prompt injection attacks to within the isolated environment.69% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1103890API
curl https://kongchang.com/api/v1/knowledge/claims/1103890MCP
get_claim(id=1103890)