NVIDIA OpenShell Has a Sandbox Escape Bug. AI Infrastructure Gets Its Own Attack Surface

• The Mess: The third topic is CVE-2026-65093, a vulnerability affecting NVIDIA OpenShell for Linux. NVIDIA has issued a security update because the flaw can let an attacker escape the intended sandbox boundary and potentially reach code execution, privilege escalation, data manipulation or information disclosure.

And it gets worse: CVE-2026-65093 isn’t the only serious bug in the bulletin.

NVIDIA’s August security update covers a whole cluster of flaws in OpenShell and NemoClaw. Alongside the 9.9 sandbox escape, OpenShell also has another CVSS 9.9 vulnerability, CVE-2026-65083, involving incomplete validation in the sandbox provisioning API. NVIDIA also fixed command injection, path traversal and other issues.

The headline bug, though, is still nasty.

CVE-2026-65093 affects OpenShell versions through 0.0.33. An attacker with network access and the required low-level privileges can escape the sandbox, potentially leading to code execution, privilege escalation, data tampering and information disclosure. The vulnerability carries a CVSS score of 9.9.

That’s exactly what a sandbox is supposed to prevent.

You put untrusted or isolated workloads inside a restricted environment.

The boundary holds.

Nothing gets out.

Except, apparently, when the boundary itself is vulnerable.

• The Damage: A successful sandbox escape can turn a restricted workload into a much bigger compromise, potentially giving an attacker access beyond the environment they were originally supposed to be trapped inside.

This matters because AI infrastructure is rapidly building its own stack of software.

Inference services.

Agents.

Gateways.

Sandboxes.

Remote-access helpers.

Model-management components.

And every new layer brings more code.

More APIs.

More credentials.

More things listening on the network.

The NVIDIA bulletin is a pretty good example of how fast this attack surface is expanding.

OpenShell alone received fixes for sandbox escape, command injection and policy-bypass issues. NemoClaw received fixes for weak authentication, missing authentication, command injection, unsafe installation workflows and credential protection problems.

That’s a lot of security debt for software that exists specifically to help run AI workloads.

And these environments can be interesting targets.

AI infrastructure may have access to proprietary models, internal datasets, API credentials, cloud services and powerful compute resources.

A compromised AI server isn’t necessarily just another Linux box.

It might be a very expensive Linux box with access to everything.

• The Fix: Upgrade NVIDIA OpenShell to v0.0.34 immediately. The security bulletin lists versions from 0 through 0.0.33 as affected by CVE-2026-65093 and identifies v0.0.34 as the updated version containing the fix. Also review the broader NVIDIA bulletin because multiple OpenShell and NemoClaw vulnerabilities were fixed at the same time.

And don’t just patch the one CVE because it has the biggest number.

Inventory the stack.

If you’re running OpenShell or NemoClaw, check every component.

Check who can access the services.

Check exposed gateways.

Check credentials.

Check logs for unexpected command execution.

And remember that sandboxing is not magic.

A sandbox is software.

Software has bugs.

When the bug is in the thing enforcing the boundary, the consequences can be much larger than an ordinary application crash.

Bugstoday Opinion

AI infrastructure is starting to collect vulnerabilities the same way every other technology stack did.

First comes the excitement.

Then the frameworks.

Then the agents.

Then the integrations.

Then somebody finds out the sandbox isn’t actually keeping everything inside.

CVE-2026-65093 is a 9.9-rated reminder that “AI infrastructure” does not magically mean “secure infrastructure.”

It’s Linux.

It’s network services.

It’s APIs.

It’s credentials.

It’s code.

And code breaks.

Bugstoday verdict: patch OpenShell to v0.0.34. If your security model depends on a sandbox boundary, a 9.9 sandbox escape is exactly the kind of bug you don’t want sitting in production while you wait for the next maintenance window.