Ali Golshan (NVIDIA OpenShell) × @Hesamation: agents in a zoo, least privilege and runtime controls — denser notes · Don't Panic Digest More
What this is: Nearer-verbatim notes from a public X interview video. Not a court transcript. Gaps labeled. Disfluencies lightly cleaned. Hosting ≠ endorsement.
Not Code Solutions LLC viewpoints or advice. Speakers' claims stay speakers' claims ([unverified] / host-said / guest-said).
Notes of a public interview, not product guidance. Nothing here is a recommendation to adopt, buy or configure any product, service or security control.
Hedge legend: [inaudible] = words not recoverable · [unclear] / [unclear: …] = partial or uncertain audio · [gap: …] = missing coverage · Intent/[unverified] = claims, figures, incidents and product statements not checked · host-said = interviewer framing · guest-said = attributed to the guest, not checked.
Speaker claims: Claims are the speakers' own [unverified] — not checked, not restated as fact. Examples: the "700 AI agents from OpenAI breaking out of a sandbox and hacking Hugging Face" figure and incident (host-said, unverified; the guest says he has no visibility into OpenAI's systems); the account of a researcher who left Anthropic (host-said); the interviewer's bio of the guest and the Jensen Huang quote (host-said); the Hugging Face blog position that OpenShell plus their own tools could have prevented the incident (guest-said, unverified); and all OpenShell product and architecture statements (guest-said). The post text also says OpenShell is "now built into Anthropic's Claude Managed Agents" — that line is from the post text only, is not said in the video as heard, and is [unverified]. Timestamps are approximate (player time).
Source URL: https://x.com/Hesamation/status/2116615587736510835
Full video duration: 17:19 (native X) · Scope: 0:00–17:19
Host: @Hesamation (interviewer; name not spoken on audio) · Guest: Ali Golshan, introduced as Senior Director of Product for AI and OpenShell at NVIDIA (host-said).
Posted: Sat 2026-10-31 · Notes desk: 2026-11-02
Method: Machine transcript of the full video, checked against two timestamped watch passes. Names normalized where clearly intended (Golshan, OpenShell, Hugging Face, Kubernetes, BlueField, DOCA). Third-party names (NVIDIA, OpenAI, Anthropic, Hugging Face, Gretel, Juniper, Red Hat, Dreamforce, Linux) kept as spoken.
Disclaimer: https://legal.codesolutionsllc.com/si-disclaimer — Notes of a public interview — not Code Solutions LLC views or advice.
[0:00] Ali Golshan: You can sort of live in this world of where, you know, "I wish the agent would do this," or "I hope it does this," or "agent, please make sure you do this." Like, you can't live in that world.
[0:08] Ali Golshan: If an agent is leaking, or if it's prompt-injected, it doesn't have anything to leak.
[0:13] Ali Golshan: A water moat doesn't help you much to contain an eagle, and, you know, like a thin mesh doesn't do much for you to contain a lion.
[0:19] Ali Golshan: I've never seen these step-function changes as crisis.
[0:22] Host: So today we're having a discussion with Ali Golshan, Senior Director of Product for AI and OpenShell at NVIDIA. Ali has spent his career on one problem: how do you secure software that cannot be fully trusted? He started in security research in the US intelligence community, and he helped co-found three companies that were later acquired by Juniper, Red Hat and NVIDIA. And at NVIDIA he helped build OpenShell, an open, secure runtime for AI agents. (host-said)
[0:53] Host: Now, the timing of this interview is perfect, because we're having more people from frontier labs that are talking about extinction risks, and we have Washington debating about an AI kill switch. And just last summer we had 700 AI agents from OpenAI breaking out of a sandbox and hacking Hugging Face. [host-said, unverified]
[1:15] Host: So just to get us straight to the point: in September, a researcher who left Anthropic [name omitted] said that labs are racing towards self-improving superintelligence. And we had other people from these labs warning about extinction risks. (host-said) Do you think the security risks that are talked about from AI agents — are they overblown, or are they real?
[1:40] Ali Golshan: Yeah, thanks for having me, I appreciate the time. So I think when we think about this — me and my co-founders, [unclear: first names as heard "Alison" / "Alex"] and John, who came from Gretel to NVIDIA and built OpenShell — we've been in security for a good 20 years of our career. And every time there is a form factor change — we saw this in mobile, we saw this in cloud computing — you can't just sort of lift and shift things, because you basically have a technology running in an environment that was not designed for it. And what we see from agents is very much the same.
[2:14] Ali Golshan: So I think what we do need is significantly accelerating security research for AI agents. But if you look at, for example, some of the scenarios you mentioned, if you break those down to the most [unclear: "quantum" as heard] level, those are the types of engineering and security problems we know how to solve.
[2:31] Ali Golshan: Now, what agents and models are really good at doing is combining those techniques in new, novel ways, executing on them at machine speed. So detecting them, responding to them in an environment that was not designed for it, or with tooling that was not meant for that, is incredibly difficult — sort of borderline impossible. And that brings ambiguity. But at the end of the day we see this, at the most granular levels, as a number of security problems we have to solve in a new way, with new engineering techniques.
[2:59] Host: So in the end it just boils down to a few engineering problems, rather than, on a grand scale, AI is going to kill humans or things like that.
[3:07] Ali Golshan: Yeah, maybe it's sort of the old-timer security in me, but I just don't see it like that. We've solved enough of these problems that I think it's about the right environment. That was really our mission and approach with OpenShell and the runtime. It wasn't initially even an agent runtime. We actually started thinking about the problem in the context of: what does an agent-native or AI-native software stack look like? And then how do you create that environment so these systems can run natively, but you can control them using deterministic controls?
[3:37] Host: When you look at the Hugging Face incident, and everything that has been going on inside OpenAI's infrastructure over the days, it just boils down to multiple small things that, with proper monitoring, with proper sandboxing or networking, could have been avoided, right? (host-said, unverified)
[3:55] Ali Golshan: Completely agree. So the way we think about these types of environments is, first of all, you really do have to monitor and instrument agents, because if you have visibility, you can verify. If you can verify, then you can trust things. So that's one side of it.
[4:09] Ali Golshan: The other part, to your exact point: if you think about what those models and agents did — potentially compounding credentials and access, using third-party tools they were not supposed to have access to, being only one hop away in a very simple way to get on the web — those are controls we can put into place, and make sure they're not designed in a way for agents to take advantage of them.
[4:29] Ali Golshan: And at the same time, the other part is that if you're overly ambiguous with your instructions for agents — agents are just really great problem solvers, and they will try to find the shortest path. So these are all things that boil back down to what a native environment for them looks like, and how you communicate that in a declarative way.
[4:45] Host: And you have been in the security field for much longer than AI has been around. To you, does it seem like right now we are in the middle of a crisis, or is it simply [unclear] a state of safety and security that we can solve?
[5:01] Ali Golshan: Yeah, so, you know, I've never seen these step function changes as crisis. Every time you have a new step function, it sort of breaks something and you have to adjust to it. So the way I see it is that we're at that phase where a technology is becoming incredibly mature, operationalized at scale because it's valuable, yet we're still using legacy technologies and tools to solve for it.
[5:23] Ali Golshan: So that's where my point is about where ambiguity is created — where people feel like, "Oh, it's chaotic," or "it's highly risky," or there are these doomsday views of it. But if you fundamentally break it down, you kind of see this.
[5:35] Ali Golshan: One of the good examples: when we originally saw cloud-native technology, people were trying to take monolithic applications, put them in containers and run them on Kube[rnetes]. The first thing was, "Well, why doesn't the container give me the same boundary that a VM does?" Well, because you're supposed to run it immutable, ephemeral, as microservices.
[5:51] Ali Golshan: So that's the step function, where we now have agents that are productive, and long-horizon agents, where you can't just force-fit them into an environment. You have to redesign for running these agents. And that's the gap we're seeing right now in the industry.
[6:05] Host: And jumping on the topic of regulations: now we have some of the frontier labs asking governments to step in and put in new laws. And Jensen Huang said at Dreamforce — just to quote — "we don't need any new laws." (host-said) From the standpoint of a security researcher, do you think we need new laws to make sure things don't go wrong from here?
[6:31] Ali Golshan: Yeah, I think new laws should be built on existing laws and regulations applied the right way, right? This is nothing novel to say, but if a human hacked into another organization, they would be liable. So why not have the same liability or compliance or regulatory laws apply to everything we do? And then go off and say, okay, now we need to build additional laws, whether it's for privacy or controls, on top of that.
[6:57] Ali Golshan: I don't think we've even gotten to a good place to say: okay, let's take all the existing laws, policies and regulations, apply them, put the right controls in, use this as a jumping-off point, and then figure out what the gap is. But to say that something is so advanced that we can't contain it, therefore we have to throw out laws and restart — that doesn't sound like the right starting point for me, right?
[7:17] Ali Golshan: If you think about even liability laws, when we built cars or when we built advanced technology, all those things still apply across the board. We built new laws when we found out, "Oh, this gap is now created that we can't cover." And I just don't think we're quite there yet.
[7:32] Ali Golshan: I think there's a lot of security research and a lot of engineering work that needs to be done that will cover a significant amount of the risk that exists right now. And then on top of that we can figure out, okay, what is not a technology problem, where we need rules or regulations. But I just don't see that we're there yet.
[7:48] Host: Okay. And so could you please explain in more detail what OpenShell is, and how what you built is different from a sandbox / container?
[7:59] Ali Golshan: Yeah, so OpenShell is a runtime that uses sandboxes to run agents or harnesses. OpenShell is Apache 2.0; it's purely open source. And it is a runtime where you can run any agent, any harness, any tool workload inside it.
[8:15] Ali Golshan: And the premise goes back to what we said about what an agent-native or AI-native software stack looks like. Our premise, as the team who built this, was: agents and harnesses should never really talk directly to your host or network or infrastructure. So at the lowest level, they should always just run in a sandbox.
[8:33] Ali Golshan: But to your point, sandboxing is also somewhat antiquated technology to apply to agents specifically. Because a sandbox is really, in its true definition, supposed to keep things out, or keep things in or out. And agents need to do both. So we had to think about it from the context of: what do you do to isolate them? What do you do to govern them and control them?
[8:53] Ali Golshan: So the analogy I use is: think of OpenShell as a zoo, and every agent is a different type of animal with a different capability, and how you create the enclosure for each one depends on their capabilities, right? A water moat doesn't help you much to contain an eagle, and a thin mesh doesn't do much for you to contain a lion. So it's all about the capabilities, and that's really what OpenShell is.
[9:17] Ali Golshan: It starts very agnostic. Models, harnesses, anything can run inside it. It's also infrastructure-agnostic: use our compute driver so you can run it on top of any infrastructure. There's no lock-in.
[9:29] Ali Golshan: And it's meant to give you a zero trust, least privileges environment to start with agents. When an agent starts, rather than saying, "Oh, we've got to close this port or this service or this tool from it," and essentially forcing it into a friction environment to find a new path, OpenShell starts it with no rights and privileges, and then starts to open things up as it starts to do work.
[9:50] Ali Golshan: As it does that, credentials and secrets and tokens — all these things are handled outside the enclosure. So if an agent is leaking, or if it's prompt-injected, it doesn't have anything to leak. The blast radius is really, quote unquote, the sandbox or the isolation environment.
[10:05] Ali Golshan: And more importantly, to your point: a sandbox is where a single agent does a single unit of work or compute. A runtime is where fleets of agents can work together over long horizons. So that is ultimately what OpenShell has been built for.
[10:21] Host: And do you think, if OpenAI used OpenShell, it would have stopped the Hugging Face incident, or the other internal incidents that we are hearing about? (host-said)
[10:30] Ali Golshan: Yeah. So obviously we don't have visibility directly into what OpenAI's infrastructure looks like. We don't have the logs, the details, the traces to understand that.
[10:38] Ali Golshan: But what I like to point to is that Clem from Hugging Face published a really great blog. Their team put together a really nice implementation of OpenShell plus a few tools that they built. And Hugging Face's position was: if we had OpenShell with these tools that we built, we would actually be able to prevent this infiltration and exfiltration of potentially sensitive information from our network. [guest-said, unverified]
[10:57] Ali Golshan: So from the Hugging Face side, it certainly looked like OpenShell, with some of the extendability features we have, could have played a preventative and hardening role. On the OpenAI side, I just don't know.
[11:07] Host: Okay. It looks like you built something from the ground up — you reimagined the type of infrastructure we need for agents. When you look at the broad landscape of AI infrastructure, do you think we are still thinking in the old methods and just trying to patch things we already had to make them adaptable to agents? Or do we need a completely new, redesigned way of thinking about how we do these things?
[11:36] Ali Golshan: Yeah, so we can't just completely disregard legacy infrastructure, right? We have to take the right actions around it. But at the same time, our view is that agents really need kind of their own cloud. They need to run in a native infrastructure, and we need to rethink that.
[11:55] Ali Golshan: A very simple transition step: our traditional infrastructure was built on retrieval-based systems, and now we have generative-based systems with agents. So it's very difficult to build the right controls and try to patch for everything.
[12:07] Ali Golshan: So our view is that if you want to run long-horizon agents — ones that at certain points, for example, launch their own fleets of agents with very specific capabilities, building tools, analyzing sensitive information over long periods of time — then you should think of it as a redesign built from the ground up. So you have deterministic controls, deterministic policies, full-stack governance, because it's a shared responsibility model.
[12:32] Ali Golshan: And part of this thinking is that over the last four or five years, because we built models and harnesses and agents, we naturally built all the governance, all the controls, all the enforcement at that layer. So what we thought about is: you have the application layer — what can you offload into the runtime, which is OpenShell? And further, how can OpenShell even project some of those policies into hardware infrastructure, to create a very deterministic, verifiable boundary to everything you have.
[12:59] Ali Golshan: So that's the thinking we have. OpenShell itself is just software. It's a runtime, so it runs at that layer. We use Linux kernel primitives to enforce some of those things out of the process of the agent.
[13:10] Ali Golshan: At this conference, we're announcing the OpenShell reference architecture, which shows how you can take certain controls — like gaining additional visibility or logging from the agent, or getting controls into the hardware — and bring those into hardware. We have this demonstrated with other things like BlueField or [unclear: "Sentry" as heard], DOCA. These are all technologies we've built that demonstrate how some of that networking boundary can be moved into the hardware.
[13:38] Host: Okay, and now I want to talk about alignment a little bit. NVIDIA's post on open agent safety platforms is that agent drift can be trained away without losing capability, and that an agent can't be expected to fully govern its own behavior. And it sounds like a bet on security rather than alignment. (host-said) So from your standpoint, do you think we still need alignment? Do you think it has been working so far?
[14:08] Ali Golshan: Well, I mean, clearly if we have breakouts, it's not fully working, so it needs some work. The way we see it right now is, like everything, when you have a new form factor and a new technology, as the capabilities grow you have to think about whether your original implementation still makes sense.
[14:25] Ali Golshan: So do I think labs should still do model alignment? Absolutely. I think there are a lot of things you can pre-train, post-train, RL, all that sort of stuff. But if you're a large organization, you're a business, you're in a regulated industry, your business depends on certain things — you can sort of live in this world of "I wish the agent would do this," or "I hope it does this," or "agent, please make sure you do this." Like, you can't live in that world.
[14:47] Ali Golshan: So the reason we created OpenShell [unclear: two words as heard "as RV"] was: well, you have to take some of those alignment requirements and force the agent to follow them, where the agent doesn't get a choice — it can't reason about it, can't decide whether it wants to follow them or not. Your business says, "This is the boundary." You have to stay within this; you can't reason outside it. They have to be enforced at a layer where it is the organization's or the human's choice, not just the agent's choice.
[15:10] Ali Golshan: So we are starting to see that alignment takes different forms. Yes, leave some of it for the model; enforce some of it without the choice or the ability for the model to bypass it. So some of it conditional, and some enforced where the agent gets no choice around it. This goes back to why we believe it's a full-stack requirement: you have to enforce alignment at different parts of the stack. And the more it matters in terms of criticality or regulation or laws, the lower you implement it, and obviously the better visibility and enforcement you have.
[15:44] Host: Yeah, and it looks like alignment and safety just go hand in hand. You're hoping the agent wouldn't do something that is unaligned, but in case it does, you want to make sure you stop it, or at least detect it early on.
[15:57] Ali Golshan: Yes.
[15:58] Host: So I want to ask: what do you suggest for someone who is just getting into the AI safety field — the roadmap they have to follow, what they should be working on — especially in a field that keeps changing so rapidly every few months? Do you have any suggestions?
[16:15] Ali Golshan: Yeah. So one that we've seen work really well is to fundamentally understand good security best practices, right? Some of those things don't go away. Understanding fundamentally how security works, how you can leverage primitives from existing infrastructure or operating systems to enforce security — really understanding security implementation, hardening, enforcement, configuration management. These are all tools that significantly reduce attack surface scope. Those are all really good practices.
[16:45] Ali Golshan: I think you have to balance that with some level of understanding of what agents are capable of and how they actually work. So my biggest recommendation — and our team talks about this all the time — is: do applied and practical work. Don't be theoretical. Don't just philosophize about what can be done and write papers. Really get your hands dirty and understand how these things work, because a lot of the really interesting things you find are at the edges.
[17:10] Host: Yeah, thank you very much for having this session with me.
[17:12] Ali Golshan: Of course. I really enjoyed that.
[17:13] Host: Absolutely, thank you very much for your time.
[17:14] Ali Golshan: Yeah, thank you.