OpenShell is NVIDIA's runtime for running fleets of autonomous AI agents inside isolated sandboxes. The project's premise is that agents are most useful when they can read files, install packages, call APIs and use credentials, and OpenShell aims to provide that capability without giving them unrestricted access to data, secrets or the network. Operators declare what each agent can touch in a policy, and OpenShell enforces it. Enforcement works in two ways. At runtime, kernel controls confine which files an agent can access and which system calls it can make, and every network connection passes through a policy check before it leaves the sandbox; agents never see real credentials, because OpenShell adds them only to requests bound for approved endpoints. For policy changes, formal verification is used to flag risky new access, such as reaching a new host with credentials or calling a new API method, so that those changes wait for human review. An advisor and a prover are provided for reviewing policy changes. Installation is a curl-based install script that sets up the CLI and a local gateway, followed by openshell sandbox create --name demo. The default sandbox image is minimal Ubuntu with no agent installed, and a walkthrough runs OpenCode against a free OpenRouter model. Requirements are Linux, macOS on Apple Silicon, or Windows with WSL 2 (marked experimental), plus Docker, Podman or host virtualization. The gateway can be deployed to Kubernetes with Helm, provided the CNI enforces NetworkPolicy. SDKs for Python, TypeScript, Go and Rust connect applications to a gateway, and extension points include middleware, interceptors and compute drivers. Public agent skills can be added with npx skills add NVIDIA/OpenShell. The repository is written mainly in Rust and licensed under Apache License 2.0. OpenShell collects anonymous telemetry limited to operational categories and counts, which can be turned off with a gateway setting (or a Helm value) or compiled out entirely.