AI Agent Security: OpenShell, Memory Tools and Firecrawl's Raise

Agents are getting memory, and the risks grow with it

AI agents are being built to remember more, run longer, and pull in more of the open web. The open-source momentum this autumn reflects that. A trends roundup from early October named three leading categories: autonomous coding agents, persistent memory systems, and multi-agent orchestration frameworks 5. Projects such as context-mode, claude-mem, and mem0 were highlighted for extending long-term context retention, which the report called critical for agents to be reliable in real-world use 5.

This article argues that each of those capabilities also adds exposure. An agent that keeps context across sessions, ingests web content at scale, and calls tools on its own has more paths for something to go wrong. The sources do not spell out memory-poisoning attacks in detail. Still, the infrastructure gaining traction points the same way: the industry is building the memory and the knowledge pipelines while also racing to add guardrails around them.

Nvidia's answer: put the agent in a box

The most concrete security move came from Nvidia. It announced OpenShell, an open-source runtime for constraining autonomous agents, at GTC San Jose 2026 1. The project is released under the Apache 2.0 license 1. Version 0.1.0 is pitched as a way to add enforceable controls to agents without rewriting their code 2.

Here is how it works, as described by both outlets covering it:

• Kernel-level isolation. OpenShell uses Landlock LSM to restrict filesystem access and seccomp BPF to filter system calls 1. Nvidia says these operating-system controls limit file access and prevent privilege escalation inside sandboxes 2.
• Policy files. Permissions are defined in YAML policy files, which administrators can update live 1.
• Network inspection. Outbound traffic is limited to configured services. Supervisors can inspect HTTP, GraphQL, and Model Context Protocol traffic, allowing read queries while blocking harmful writes through the same API 2.
• Audit trails and formal policy analysis. These features are highlighted as tools for teams trying to balance capability against risk 12.

Cisco is reported as a backer 1. The framing differs slightly between the two outlets. One stresses keeping agents "on a leash" 1. The other emphasizes that the controls let agents run longer and more safely 2. Those are two sides of the same pitch: containment is what makes extended autonomy acceptable to an enterprise.

Developers appear interested. OpenShell's repository reportedly had about 8,600 stars and 1,390 commits as of September 1. The October trends report recorded 2,456 new stars in its tracking window 5.

Firecrawl and the knowledge-ingestion boom

On the data side, Firecrawl is raising a lot of money to feed agents more of the web. Accounts of the round disagree on the figures.

One report describes a $75 million Series B led by Smash Capital, with Altos Ventures, Nexus Venture Partners, Y Combinator, Freestyle, and Offline Ventures participating 3. It also includes a confusing parenthetical conversion to roughly $102.3 million 3.

A separate report, based on an SEC Form D filed September 14, says Firecrawl sold $82,063,463 in preferred stock to seven investors 4. That filing lists no valuation, round label, or investor names 4. It gives August 31, 2026 as the date of first sale 4.

The accounts also differ on the prior round. One cites a $20.7 million Series A led by Nexus and Y Combinator 3. The other cites $14.5 million led by Nexus in 2025 4. The gap may come from extensions, currency conversions, or different ways of counting. The regulatory filing is the firmest number available.

What the reports agree on is direction. Firecrawl builds open-source tools to extract and structure web data for AI developers and agents 3. It claims more than 1.5 million developers and 150,000 companies as users, including Shopify, Apple, Lovable, and Canva 3. The new money will fund Alexandria, a platform that aggregates knowledge from many sources for models and agents 3. The SEC-based report says the challenge is turning open-source distribution into durable enterprise revenue across search, scraping, and browser agents 4. The trends roundup groups Firecrawl with graphify and ragflow as signs of rising demand for high-fidelity knowledge grounding from web data 5.

Reading the pattern

These threads describe one architecture forming in real time:

1. Memory layers keep context across sessions.
2. Ingestion platforms pipe web content into that context.
3. Runtimes like OpenShell try to limit what an agent can do with whatever it has absorbed.

The likely weak point is between the second and third layers. Sandboxes and network policies limit the damage an agent can cause. They do not decide whether the information an agent remembers is trustworthy. Content scraped from the web and stored persistently could carry manipulated instructions forward into future sessions. That is an inference, not something these reports document.

Nvidia's MCP-aware traffic inspection and write-blocking controls suggest that vendors expect agents to be misled and want to cap the consequences 2. In practice, teams adopting memory and web-grounding tools should treat persistent context as untrusted input. Containment runtimes are necessary, but they are only one part of the defense.