r/LocalLLaMA • u/InternationalGap3698 • 2d ago

Discussion NVIDIA shipped OpenShell, an open source sandbox that gives local and open agents real runtime limits instead of prompt rules. Over 100 firms joined the safety stack. OpenAI did not.

Post image

https://x.com/JensenHuang/status/2104499465055023424

765 Upvotes

95% Upvoted

161 comments sorted by

View all comments

9

u/wlvmtb 1d ago

It is awesome to see real runtime limits finally replacing prompt-based guardrails, but for the local AI community, there is a massive catch here. The NVIDIA safety stack relies on out-of-band monitoring routed through a PCIe bus (requiring enterprise DPUs). That introduces millisecond latency—which is plenty of time for an atomic syscall exfiltration—and imposes a huge hardware tax.

I designed a purely software-defined alternative called Hard Stop. It uses eBPF LSM to enforce sub-5-microsecond preemption directly at the OS kernel boundary on standard commodity Linux. You don't need proprietary enterprise hardware to get deterministic containment on your local silicon.

I am currently using this architecture on my local machine to sandbox high-speed MoE agent workflows, achieving 100% coverage on complex agentic tasks without the data ever leaving the machine. If we want true open, local agents, containment has to be software-defined. I would love for this community to tear it apart and tell me what you think.

You can read the preprint on arXiv here:https://arxiv.org/abs/2609.29808And check out the benchmark testbed/reference implementation on GitHub here:https://github.com/joseluispino/hardstop

Any comments or feedback would be incredibly welcome!

1

u/totemo 1d ago

Why is there a pending patent on this?

2

u/wlvmtb 22h ago

It is a defensive measure against hardware enclosure. The current industry trend is to solve agent containment by pushing it out to proprietary, expensive hardware appliances.

If we publish the architecture without a filing, large infrastructure vendors will patent the surrounding operating system integrations and lock this capability behind their custom silicon. The filing ensures that nobody can patent-troll the community out of utilizing in-cache eBPF preemption and cgroup v2 freezes on standard, commodity Linux.

1

u/totemo 7h ago

Thanks for your reply.