NVIDIA Says Sandboxes Are Obsolete—The Comments Section Disagrees First

Ali Golshan, Senior Director of AI Software at NVIDIA, spoke with Hesamation at GTC Berlin and set the tone for OpenShell: traditional sandboxes are not enough. He leads NVIDIA's open-source agent runtime OpenShell, which is already built into Anthropic's Claude Managed Agents.

Golshan nails the definition of a sandbox: its original job is to keep things from getting out, or to keep things from getting in. The problem is that an agent has to do both. It needs to call external tools, access the network, and read task-relevant data, while also keeping secrets it should not touch out. A traditional sandbox is like a fixed box, but an agent is an executor that moves through workflows with tools, keys, and memory, and risk moves with every step.

According to Golshan, OpenShell's mechanism has three parts: agents start with zero permissions; more access is granted only when the task actually requires it; and secrets stay outside containment, so the agent cannot obtain them directly. It sounds like moving the security boundary from static isolation to dynamic authorization.

The comments section did not stop at retweets. David Arnal said that starting from zero permissions is a reasonable design, but the real test is whether expanding permissions can avoid creating new leak paths. AI Quanting was more direct: zero permissions plus on-demand expansion is exactly what a sandbox is supposed to do, and calling sandboxes "antiquated" did the product a lot of favors. Benjamin Wolfe argued that the real boundary is a short-lived, scoped key for each task; without that, a sandbox only feels safe. Jatin Garg added that the broker still has to reject harmful requests sent by an already-authorized agent. Joel Stahre raised another side: agents need access to the open internet to be useful, and prompt injection happens to live there.

Original tweet link: https://x.com/Hesamation/status/2117315362081456589

Quoted tweet link: https://x.com/Hesamation/status/2116615587736510835

Calling sandboxes obsolete while making zero permissions, on-demand permission expansion, and secret isolation selling points will of course lead the comments section to ask: is the difference between this and a sandbox one of implementation or naming? OpenShell also has to answer more than conceptual questions. How is least privilege enforced, how is the secret lifecycle managed, how are post-authorization requests rejected, and can it fail closed when tools go off track? These details determine whether agent security has simply changed boxes or changed to an entirely different permission flow.