# A shell is not a weight

Canonical: https://owterminal.com/notes/a-shell-is-not-a-weight

Author: @iammrriver (https://owterminal.com/authors/iammrriver)

Published: 2026-09-28
Updated: 2026-09-28
Type: analysis

Mikko Haapoja posted one line and a link. The link is NVIDIA OpenShell. It keeps an agent inside a policy. It does not serve a model, and this desk did not run it.

Original post: @MikkoH — https://x.com/MikkoH/status/2104553843585417650

> This is cool

> OpenShell is a sandbox NVIDIA published. A tok/s on this desk is still a serving number. The shell does not change the weight.

## The pointer

The post is two words and a link, https://github.com/NVIDIA/OpenShell/. He did not publish a speed. The runtime is NVIDIA's. The pointer is his. The bio on the post says he builds AI at Opendoor, and before that at Shopify. That is a bio. It is not a review.



## What NVIDIA printed

The repo calls OpenShell the safe, private runtime for fleets of autonomous AI agents. An agent may read files, install packages, call APIs, and use credentials. A policy says what it may touch. NVIDIA says the kernel enforces that policy on file access, system calls, and network connections, and a prover checks a policy change before it is applied. The agent does not hold the real credential. The credential is added only on a call the policy allows. Linux and Apple Silicon are listed. Windows is listed through WSL 2 and marked experimental. The license is Apache 2.0. Their architecture page names a gateway, a supervisor, and a sandbox: https://docs.nvidia.com/openshell/latest/about/architecture. This desk did not install the script and did not test those claims.



## Still a serving number

A decode on /hardware is tokens per second after the prompt is in. /payback turns that number into months at a US street price. An agent sitting in a sandbox does not change either page. A file on /recipes is still how a named load is installed. OpenShell does not print a tok/s, and it does not replace the weight.



## Two sentences about privacy

NVIDIA says the agent never sees the credential. /inference says the prompt is wiped when a machine takes the job, and the ledger keeps the count, not the words. Those are different sentences. One is their runtime. One is this desk. Neither one proves the other.



## Method and limitations

Legacy edition, predating the current research standard. A proposed rewrite is awaiting editorial review. This is not an original experimental report; historical prices and product statements should not be treated as current guarantees.

## Sources