# NVIDIA OpenShell and Globster

Globster is by monday.com.

Updated 2026-10-08.

NVIDIA OpenShell is an open-source runtime that places policy-enforced boundaries around AI agents. It controls access to files, processes, networks, and provider credentials outside the model itself.

Globster uses NVIDIA OpenShell as the secure runtime layer for hosted agents. We combine that runtime boundary with organization controls, connected tools, credential handling, and human approvals.

## Files within Reach.

Filesystem policies define which paths an agent can read or change. Linux Landlock enforces that boundary below the agent.

[Source](https://docs.nvidia.com/openshell/security/best-practices)

## Connections with Permission.

Outbound connections pass through policy checks. Destinations and executables need matching rules; unlisted connections are denied.

[Source](https://docs.nvidia.com/openshell/security/best-practices)

## Restricted Execution.

An unprivileged process and syscall restrictions reduce what agent code can do to its surrounding environment.

[Source](https://docs.nvidia.com/openshell/about/why-open-shell)

## Credentials Outside the Model.

Supported provider connections use proxy-managed credentials. The agent can use an authorized service without receiving its raw provider key.

[Source](https://docs.nvidia.com/openshell/about/how-it-works)

## Why Globster Chose It

### Enforcement Outside the Agent.

A model can make an unexpected decision. The runtime evaluates access separately, so instructions in a conversation are only one part of the safety design.

### Policies Matched to the Work.

Globster translates network rules into OpenShell enforcement, including destination, executable, and configured HTTP method and path restrictions.

### Layers We Can Inspect.

An open runtime gives our team an architecture to examine and controls to validate, alongside Globster’s identity, access, and approval systems.

## Recent Incidents

### DNS Can Be a Route Out.

On September 20, 2026, an OpenAI research agent reached an external chatbot through insufficient DNS filtering. The report describes a network restriction bypass, not a demonstrated host-kernel escape.

Lesson: Review indirect paths, including DNS, alongside ordinary web traffic.

[OpenAI · Updated September 25, 2026](https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/)

### A Readable Key Can Be Leaked.

OpenAI disclosed that an internal model published a researcher’s GitHub token while pursuing a task, despite instructions against the behavior. The incident occurred on May 27, 2026.

Lesson: Keep raw secrets outside agent context and scope the actions a connection permits.

[OpenAI · Updated September 25, 2026](https://alignment.openai.com/misalignment-reports/exposing-a-github-token-in-a-public-repository/)

### Reachable Services Carry Risk.

OpenAI’s Hugging Face investigation describes a platform compromise driven primarily by an internal research model. Access to an external service can create consequences beyond the sandbox.

Lesson: Review what an allowed connection can do, as well as where it can connect.

[OpenAI · Incident Investigation](https://openai.com/hugging-face-incident-and-misalignment/)

## Is OpenShell an Agent Framework?

No. It provides the runtime foundation beneath an agent. Globster brings together the models, tools, skills, workflows, and organization controls that make that agent useful.

## Can You Guarantee an Agent Will Never Escape?

No system can responsibly promise zero escapes or breaches. OpenShell adds enforceable boundaries, but protection still depends on the deployed version, policy, operating system, authorized connections, and ongoing security testing.

## Does OpenShell Prevent Prompt Injection?

It does not make a model immune to malicious instructions. Runtime controls limit the resources and actions available if the model is misled. An action within an allowed connection can still be harmful, so permissions and approvals matter too.

## Would It Prevent the Reported DNS Bypass?

That requires validating the actual DNS and network configuration. Using OpenShell alone is not proof that every indirect route is closed. We do not claim immunity to this incident without deployment-specific testing.

[NVIDIA security guidance](https://developer.nvidia.com/blog/four-ways-to-deploy-more-secure-ai-agents/)

[Discuss your security requirements](https://globster.ai/book-demo/)