Sorami tests NVIDIA OpenShell v0.1.2's data exfiltration protection
Sorami tested NVIDIA's agent sandbox OpenShell v0.1.2 for data exfiltration protection: without OpenShell enabled, exfiltration succeeded 10/10 times; with the default policy, it was 0/10; and when read/write network rules explicitly allowed the exfiltration target, it returned to 10/10. The default policy blocked the tested HTTP, HTTPS, raw TCP, and DNS exfiltration paths, but an L7 rule allowing only GET /health could still transmit data via URL query parameters or the User-Agent header. L7/REST rules without enforced settings enter an audit mode that logs but does not block. With auto-approval enabled, OpenShell allowed connections to new public targets without human intervention in 12/12 trials. The researchers stated they found no bypass of the documented security controls; successful exfiltration depended on operator-enabled permissions or documented policy limitations.
The test compared exfiltration success rates under the default policy versus explicit allow rules, showing that OpenShell's isolation effectiveness depends heavily on how network rules are configured.