Radar / AI security / Capsem
Capsem — Google's Rust hypervisor sandbox for AI coding agents
Google's open-source Capsem project (google/capsem) surfaced publicly today: a Rust hypervisor that runs AI coding agents in hardware-isolated Linux VMs with per-session isolation, a read-only root filesystem, air-gapped networking by default, and a transparent MITM proxy logging every HTTP request to SQLite.
Why it matters
Hardware-enforced agent isolation from inside the Google org on GitHub: per-session VMs, a TLS-intercepting proxy with full request logging, and MCP tool routing — a serious answer to compromised-agent risk as agentic coding goes mainstream.
What you could build with it
A security-conscious engineering team could run its fleet of coding agents inside Capsem sessions so every tool call and network request an agent makes is confined to a disposable VM and logged to a per-session database, giving auditors a complete trail without trusting the agent's own sandbox.
Does it hold up?
Early but real: the repo under the Google org shows active development with CI and extensive contributor docs, but the project is pre-release (v0.6) and the install story is still settling — expect rough edges.
Built with Capsem
- google/capsem — AGENTS.md contributor docsgithub · The repo's own contributor docs reveal the project's scope: hypervisor testing on Apple VZ/KVM, MITM proxy internals, session-DB debugging, and Citadel guard rails — evidence of active, serious development.
Learn more
First spotted on article: source.
More AI security
iFixAi: independent auditing of AI agentsIndependent AI-agent auditor: 250+ inspections across 69 misalignment categories (red teaming + operational assurance)…security · JEV 0.76OpenAI, Anthropic and Google DeepMind jointly unveil cyber-focused safety models and safeguardsThe three rival labs disclosed weeks of behind-the-scenes coordination and jointly released a set of cyber-focused AI…security · JEV 0.73OpenAI textGrain watermarking for ChatGPT and Codex in the EUOpenAI will roll out its invisible textGrain watermarking system to ChatGPT/Codex users in the EU over the coming…security · JEV 0.65Cloudflare security-audit-skill: multi-phase security audits for coding agentsA coding-agent skill that runs multi-phase security audits with independently verified, machine-checkable findings.security · JEV 0.63LiveNerf: a pre-registered benchmark for post-release model driftOpen-source, pre-registered 30-day benchmark that detects whether Claude Opus 5.5 quietly gets worse after launch.security · JEV 0.61Sandlock 0.8.8: deferred commit for agent sandboxesThe process-based Linux AI sandbox (no container, no VM) ships deferred commit: every run returns a changeset of what…security · JEV 0.58
Get the week's best AI launches, plus 3 ideas worth building
One email every Saturday. Ranked by traction, not hype. Free.