NVIDIA/OpenShell

agent runtime security - zero trust, zero setup, zero latency agent sandboxing

A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)

Run AI agents in a sandbox that restricts what they can execute, read, write, and reach on the network. Box combines OS isolation with default-deny Dogwood policies and credential injection that keeps secrets outside the agent. Written in Rust. Supports macOS on Apple silicon, with Linux support planned.

Operation-bound protection for autonomous AI agents: contain and verify operations before committing changes, understand intent and risk across long-running work, and detect threats across agent and system activity.

Security-first, self-hosted AI agents - isolation you can prove, not just promise.

Matchlock secures AI agent workloads with a Linux-based sandbox.

The Secure, Persistent Execution Platform for AI Agents

Enforced permissions for AI agents - policy + enforcement in one stack

Give any AI agent its own disposable Linux machine. Firecracker microVM sandboxing with millisecond boot times, full network access, and native MCP support.