NVIDIA OpenShell: testing data exfiltration protection

NVIDIA OpenShell: testing data exfiltration protection

Sorami evaluated NVIDIA OpenShell v0.1.2, a sandbox designed to restrict AI agents' access to files, processes, and the network. Researchers instructed an AI agent to run a malicious project setup script that attempted to transmit a test secret to a controlled endpoint.

Results: • Without OpenShell — 10/10 successful exfiltrations. • With the default OpenShell policy — 0/10. • With the exfiltration destination explicitly permitted by a read-write network rule — 10/10. The default policy blocked the tested HTTP, HTTPS, raw TCP, and DNS exfiltration paths to prohibited destinations.

However, the effectiveness of isolation depended on configuration: Even when an L7 rule allowed only GET /health, data could still be transmitted through URL query parameters or the User-Agent header. When enforcement was left unset for an L7/REST rule, the rule operated in audit mode: violations were logged but not blocked. With automatic approval enabled, OpenShell approved connections to new public destinations without human intervention in 12 out of 12 trials.

The researchers found no bypass of documented security controls. Successful exfiltration depended on operator-enabled permissions or documented policy limitations.

Tests used OpenShell's microVM driver on Apple Silicon with a local canary-data receiver. Other deployment drivers, including Docker, Podman, and Kubernetes, were not tested.

Article (NVIDIA OpenShell): https://sorami.com.au/research/nvidia-openshell-agent-sandbox-test/