NVIDIA's OpenShell Ships v0.1.5 With Six Breaking Changes, Seven Months After Launch

NVIDIA released OpenShell v0.1.5 on October 20, 2026, and the release notes list six breaking changes for anyone running the open-source agent sandbox in production. The GitHub repository stood at 17.8k stars, 1.8k forks, 373 open issues and 191 open pull requests when we read it on October 23.

OpenShell is an Apache-2.0 runtime that runs an autonomous AI agent inside an isolated sandbox. Its README says kernel controls limit which files the agent can reach and which system calls it can make, and that every network connection passes a policy check before leaving. Agents never see real credentials: OpenShell attaches them only to requests bound for approved endpoints.

The six breaking changes

The release notes for v0.1.5 name each one, with the pull request that caused it.

Change	Who it hits
Supervisor OCSF logs switch from .log to .jsonl (#4263)	Anyone whose collector matches openshell-ocsf.*.log. Old files are not migrated.
Sandbox templates setting pod labels or annotations are rejected unless the operator allowlists the keys (#4497)	Direct API and SDK callers on Kubernetes, not the CLI.
Annotation keys with the internal.openshell.ai/ prefix are rejected (#4626)	Callers of CreateSandbox and UpdateConfig.
Go SDK Create() takes functional options such as WithLabels(); CreateOptions is removed (#3198)	Go users.
External compute drivers must rename outer_fence to provisioning_evidence (#3898)	Anyone writing a driver.
The snap gateway service is no longer enabled for every user (#4615)	Snap installs, which need a one-time systemctl cleanup.

The log change is the one most likely to bite quietly. A collector watching for .log files keeps running and simply stops seeing new events, so the audit trail goes dark with no error. Rename the pattern before upgrading, and copy the old files first.

What the release adds

Setting config_delivery_mode = "push" delivers policy changes over the gateway session in about 100 ms, the notes say. Polling stays the default. OCSF events can now be exported as OTLP log records, and microVM sandboxes can mount host directories through virtiofs after enable_bind_mounts = true, capped at 3 mounts on x86_64 and 32 on aarch64.

The security section lists a rustls bump to 0.23.46 for RUSTSEC-2026-0346 through RUSTSEC-2026-0349. It also says the network broker now denies operations it cannot verify rather than falling back to native handling. Build-only zip advisories were temporarily accepted, the notes say, with seven pull requests listed against them.

What the independent view says

OpenShell launched at GTC in March 2026. Mitch Ashley, vice president and practice lead at The Futurum Group, wrote on March 18 that guardrails living inside the agent process "are bypassable," and that OpenShell's answer is enforcement outside it. He also listed gaps: no third-party security audits, no regulated-industry reference deployments. "The risk is execution, not architecture," he wrote.

Seven months on, the project's own page still carries the same marks of immaturity. WSL 2 support is labelled experimental, the software is provided "AS IS," and anonymous telemetry is on by default until you set OPENSHELL_TELEMETRY_ENABLED=false. We found no published third-party audit in the pages we read.

Stars are a measure of attention, not adoption. The repository reached 17.8k while still on a 0.1.x version, and 41 commits had landed on main after the v0.1.5 tag was cut.

For other agent runtimes with weak defaults, see our look at Omnara's open-source managed agents and Cloudflare's security-audit skill.

The install script takes an OPENSHELL_VERSION variable, so operators can pin an exact release while they migrate their log collectors.