NVIDIA released a new version of OpenShell, which runs autonomous AI agents in isolated environments. Operators can choose faster policy delivery and export audit records to external log collectors. Log collection rules and some integration code also need updates.

1. Receive changes directly instead of polling

OpenShell v0.1.5 was released on October 20, 2026. It adds a new way to deliver policies and settings to agent sandboxes. Instead of sandboxes polling for changes, the gateway pushes updates to connected supervisor processes.

The company says delivery takes about 100 milliseconds in the new mode. Polling can take up to 10 seconds and remains the default. These are an approximate delivery time and a maximum wait, so the key distinction is how changes are awaited, not a speed ratio.

To use the new method, set the delivery mode to push. The gateway also separates queues for changes by workspace and sandbox. This reduces contention behind a single lock, a control preventing concurrent access, when many supervisors reconnect at once.

2. Connect audit records to external log collection

The gateway and sandbox supervisors can export records in OCSF, a common security event format. Export uses log records from OTLP, an observability data protocol. Traces and security events can also be sent to separate collection endpoints.

This export feature must be enabled in configuration. Existing configurations with a single collection endpoint retain their previous behavior. Operations teams can collect traces and audit records together or route them separately by purpose.

Denied requests are also recorded as authentication events. Records include the authentication method, denial reason category, source address, and request identifier. This adds details on how and why requests were denied, beyond the denial itself.

The event format was also refined. According to the release notes, an operating system type identifier was added to pass validation against the OCSF 1.8 schema, which defines data fields and structure. Export options and record formatting improved together.

3. Check log collection patterns and retained records first

Supervisor audit logs use dated filenames and line-delimited JSON. If an existing collector looks for openshell-ocsf.*.log, change its pattern to openshell-ocsf.*.jsonl.

Existing log files are not migrated to the new format and may be removed, so collect any needed history before upgrading. The filename change is not merely cosmetic: migration is needed to keep collectors finding new records.

4. Sandbox creation code and deployment rules change

Sandbox creation in the Go SDK now uses functional options instead of positional label arguments. The old options struct, a type grouping settings, was removed, so callers must update. Labels, annotations, and service exposure now use the new options.

In Kubernetes, operators must allowlist label and annotation keys that sandbox templates attach to pods, the deployment units running containers. Templates with unapproved keys are rejected. Direct API or SDK integrations need review; CLI metadata labels remain usable.

5. Faster updates and broader audit use require migration

The benefits are shorter policy update waits and more ways to use audit records. Teams must decide whether to enable push delivery and log export, and review collection patterns, template allowlists, and creation code. Plan feature adoption and migration together.

The release notes provide this version-specific installation example.

curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=v0.1.5 sh

OpenShell v0.1.5 brings policy changes and audit records into operational workflows faster, but using it also requires preparing to migrate existing collection and integration settings.