---
type: analysis
slug: research-claude-managed-agents-now-run-tool-calls-inside-nvidia-openshell-sandboxes-but
title: "Claude Managed Agents now run tool calls inside NVIDIA OpenShell sandboxes, but the boundary only covers what runs on your host"
description: "The Anthropic–NVIDIA announcement comes down to a working pattern: Claude's agent loop stays on Anthropic's servers while tool calls run in a customer-hosted OpenShell sandbox where everything is blocked unless a rule allows it. Anthropic's own cookbook shows that tools running on Anthropic's side, MCP routes and the session token itself sit outside that boundary."
published_at: 2026-10-22T14:00:00.000Z
topics: ["anthropic","sandbox","agents","research"]
source_urls: ["https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes","https://claude.com/blog/giving-companies-more-control-over-their-ai-agents-with-nvidia","https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes-security","https://github.com/NVIDIA/OpenShell","https://nvidianews.nvidia.com/news/open-agent-safety-platform","https://github.com/anthropics/claude-quickstarts/tree/main/managed-agents/self-hosted-sandboxes/openshell","https://thenextweb.com/news/nvidia-open-agent-safety-platform"]
author: "Andrey Reshetnikov"
author_profile: https://newruntime.com/owner-profile.md
---
On September 28, 2026, NVIDIA launched its Open Agent Safety Platform. It has two parts: OpenShell, an open-source runtime that sandboxes agents and enforces policy, and Sentry, a reference design that runs on BlueField-4 DPUs and acts as a watchdog outside the agent's machine. Anthropic was among more than 100 named partners. The same day, Anthropic published "Giving companies more control over their AI agents, with NVIDIA." The post presents Claude Managed Agents as a "brain/hands split": the harness, session state and credentials stay on Anthropic's side, and the sandbox becomes just an execution tool that the customer can host and govern with OpenShell.

This matters because prompt injection carried in repos, web pages, tool output and packages is the main threat to agents that run code. The industry answer is moving toward enforcement outside the model and the harness. The question for builders is whether this is a marketing partnership or something they can deploy, and what the boundary actually covers.

## What we checked

- **What concrete evidence would resolve the remaining editorial uncertainty for this item?** confirmed. Anthropic's blog, NVIDIA's September 28, 2026 press release, the beta self-hosted sandbox docs, the Apache-2.0 OpenShell repo and an Anthropic cookbook pinned to OpenShell 0.1.2 together confirm that a real, runnable integration exists. They also show what it does not cover. [2][5][1][6]
- **Is the BlueField/Sentry hardware integration with Claude Managed Agents documented and available to builders?** unresolved. NVIDIA's release and The Next Web say Anthropic connected Managed Agents to both OpenShell and BlueField. But Anthropic's post and cookbook only document OpenShell, and no source gives a Sentry availability date. NVIDIA also says some features are offered on a when-and-if-available basis. [5][7][2]
- **Does self-hosting the sandbox keep all agent data inside the customer perimeter?** refuted. The docs say tool inputs and outputs still flow to Anthropic's control plane, and that skills and memory stores are stored by Anthropic. Only execution, files and egress stay local. [1][3]

## What we found

- The architecture is concrete and documented. A self_hosted environment works as a work queue. A customer-run worker claims sessions, runs each tool call locally and posts results back, while Claude runs on Anthropic's side. The feature is in beta under the managed-agents-2026-04-01 header, and pre-built workers ship in the ant CLI and the Python, TypeScript and Go SDKs. [1][2]
- Self-hosting does not mean the data stays on your side. The docs say tool inputs and outputs still flow to Anthropic's control plane, and Anthropic stores skills and memory stores. The sandbox holds only a copy of the memory store, under /mnt/memory/. Self-hosted sessions accept only memory_store resources: file or github_repository resources are rejected with a 400 error. [1][3]
- OpenShell is real open-source software under the Apache 2.0 license, on its 0.1.x release line, with about 17k GitHub stars when checked. It enforces filesystem, network and process policy at the kernel level, checks every outbound connection, and adds credentials only for approved endpoints. Its policy prover uses formal verification to flag risky new access before a policy change is approved. [4][5]
- Anthropic's cookbook pins OpenShell 0.1.2 and gives each session its own sandbox. Writes are allowed only under /workspace and /tmp, and egress is limited to six method/path routes on api.anthropic.com, enforced through a TLS-inspecting proxy. Three credentials are kept apart: the org key stays off the sandbox host, the environment key stays on the host, and each sandbox holds only its own session token. [6]
- The cookbook is frank about the gaps. web_fetch, web_search and any MCP server run on Anthropic's side and bypass the sandbox policy. The agent can read its session token and use the same six routes. Logs are in memory only (2,000 lines per sandbox) and filesystem denials are not logged. Skills don't work under the policy. CPU and memory limits are not enforced under rootless Docker. It was tested only with the Docker driver. The prover's drift check compares the live policy with the repository file; it does not show what the agent actually did. [6]
- Under the shared-responsibility model, the customer owns image hardening, network egress controls, storing and rotating the environment key, per-session secrets, log retention and isolation between tools. Anthropic says it cannot verify your worker build or detect a supply-chain compromise in your image. [3]
- The hardware side is far less documented. NVIDIA and The Next Web say Anthropic integrated with both OpenShell and BlueField, and NVIDIA says Sentry can quarantine an agent within milliseconds. But that claim comes only from NVIDIA, The Next Web found no third-party testing, and NVIDIA says some features are offered on a when-and-if-available basis. [5][7]

## What it means

If you are building on Claude Managed Agents and need code execution inside your own perimeter, you can use this today. Run a self-hosted worker, wrap each session in its own OpenShell sandbox, set network enforcement to "enforce" (the default only audits) and Landlock to hard_requirement (the default is best_effort). Keep the org API key off the sandbox host. Treat the cookbook as a starting point, not a hardened product. It is a Docker-only demo with in-memory logs, no resource limits, and a session token the agent can read. Before production you need durable log shipping, cgroup limits and a retry path for stuck sessions.

Be careful how you describe this to compliance teams. The sandbox limits what code does on your host. It does not keep conversation content or tool outputs away from Anthropic, and it does not govern tools on Anthropic's side such as web_fetch, web_search or MCP connections. Each of those is another route out that you must disable or account for. Treat Sentry/BlueField as roadmap, not something you can plan around yet, until NVIDIA or Anthropic publishes integration docs and an availability date.

## Still open

- What exactly does the Anthropic–BlueField/Sentry integration consist of, is it documented, and when will Sentry ship?
- When will self-hosted sandboxes leave beta, and what will they cost on top of Managed Agents usage?
- Will OpenShell's Kubernetes and MicroVM drivers be supported for Managed Agents workers?
- Has anyone independently tested OpenShell's enforcement or Sentry's millisecond quarantine claim?

## Sources

1. [Claude Platform docs: Self-hosted sandboxes](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes) (primary)
2. [Giving companies more control over their AI agents, with NVIDIA (Claude blog)](https://claude.com/blog/giving-companies-more-control-over-their-ai-agents-with-nvidia) (primary)
3. [Claude Platform docs: Self-hosted sandboxes security model](https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes-security) (primary)
4. [NVIDIA/OpenShell GitHub repository](https://github.com/NVIDIA/OpenShell) (primary)
5. [NVIDIA Launches Open Agent Safety Platform](https://nvidianews.nvidia.com/news/open-agent-safety-platform) (primary)
6. [Anthropic cookbook: OpenShell self-hosted sandbox](https://github.com/anthropics/claude-quickstarts/tree/main/managed-agents/self-hosted-sandboxes/openshell) (primary)
7. [Nvidia launches agent safety platform backed by over 100 companies (The Next Web)](https://thenextweb.com/news/nvidia-open-agent-safety-platform)

Author: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Sandbox](https://newruntime.com/topics/sandbox.md): Explore the sandbox topic hub.
- topic hub: [Agents](https://newruntime.com/topics/agents.md): Explore the agents topic hub.
- collection: [Analysis](https://newruntime.com/analysis.json): Open the latest authorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)