Red Hat and Nvidia's OpenShell Framework Brings Security Controls to Production AI Agents
Prompt injection attacks and data theft have made AI agent security a critical enterprise challenge. Red Hat and Nvidia are addressing the threat through OpenShell, an open-source project that enforces strict access controls on autonomous agents.
The move of AI agents from development environments into production data centers has exposed serious security gaps. Malicious prompts and unauthorized data exfiltration are no longer hypothetical risks—they represent concrete threats that enterprises must now defend against. To address these challenges, Red Hat Inc. and Nvidia Corp. have deepened their collaboration by introducing OpenShell, an open-source initiative designed to constrain agent behavior through a deny-by-default security model.
The security requirements for AI agents diverge fundamentally from those of conventional applications, necessitating new architectural approaches. Derek Carr, senior distinguished engineer at Red Hat, explained the core principles: "Agents can't get access to your secrets. They need deny-by-default networking, and you need a rich policy framework for what happened and when for this class of apps." Carr noted that Nvidia identified the same problem space and recognized that collaborative development would yield better results than isolated efforts.
Carr and Mrunal Patel, distinguished engineer at Red Hat, discussed OpenShell's approach during an exclusive broadcast at KubeCon + CloudNativeCon NA on theCUBE, SiliconANGLE Media's livestreaming platform. They outlined how the framework enables enterprises to deploy AI agents in production environments while maintaining protections against prompt injection attacks and data leaks.
Prompt injection attacks force a new agent security model
High-profile projects such as OpenClaw demonstrated that agents could execute consequential actions autonomously. This capability, however, introduced legitimate concerns about credential theft and unauthorized financial transactions. Early warning signs of these risks materialized quickly. Patel recalled: "As soon as we started hearing about the prompt injection attacks and how like folks were seeing the data getting exfiltrated outside, that was scary. We realized we needed a solution."
OpenShell addresses these vulnerabilities by allowing operators to grant agents access to specific endpoints while isolating credentials from the agents themselves and restricting their scope. A policy advisor component requires agents to provide justifications for any blocked operations in natural language, enabling operators to refine policies as requirements evolve. Following Nvidia's contribution of the project to the Cloud Native Computing Foundation, OpenShell now operates under open governance. Red Hat's strategy centers on making agent deployment on OpenShift as straightforward as running traditional containerized applications, with prompt injection defenses embedded directly into the platform.
Carr emphasized the practical challenge facing organizations: "Many companies are struggling to get to one agent in production, let alone thousands or millions. By having a project like OpenShell in the ecosystem, it provides a blueprint for companies to follow — to get from their first idea of 'I want to do something with agents' to a point where they're safely doing one, 10 or 20 in production."