Capsem sandboxes AI coding agents in hardware-isolated Linux VMs
AI coding agents edit codebases, call APIs, and browse documentation. They also run on the same machine that holds your SSH keys, your AWS credentials, and your production config files. That combination makes a lot of developers nervous.
Capsem is an open-source project hosted under the Google organization on GitHub that addresses this directly. It’s a custom Rust hypervisor that spins up hardware-isolated Linux VMs purpose-built for running AI agents. Each session gets a clean environment. Boot to prompt takes under 10 seconds.
How the isolation works
Every agent session runs inside its own lightweight Linux VM. The root filesystem is read-only. No swap, no kernel modules, no debugfs. Networking defaults to air-gapped with a dummy NIC and fake DNS. Nothing reaches the real internet without passing through a transparent man-in-the-middle proxy.
That proxy terminates TLS inside the guest using per-domain certificates. It inspects every HTTP request and response, applies policies, and logs full bodies to a per-session SQLite database. Engineers can see exactly what their agent did and what it attempted.
Enterprise controls baked in
Profiles handle enforcement, detection, plugins, and assets. Corporate admins can push a config file at /etc/capsem/corp.toml via MDM. Those settings lock policy and reporting. Users cannot bypass them. MCP tool routing is supported alongside the HTTPS inspection layer.
Platform support covers macOS 14 and later on Apple Silicon, and Ubuntu 24.04 or newer plus Debian 13 or newer on x86_64 or arm64 with KVM. Ubuntu 22.04 and Debian 12 are out of scope for now.
Where things stand
Capsem 0.6 is pre-release. Current version is 0.6.2. Installation packages and instructions are withheld until the public launch scheduled for summer 2026. Documentation is live at docs.capsem.org.
Maintainers are Elie Bursztein, who leads security and anti-abuse research at Google with a focus on AI and cryptography, and Julien Cretin. The repository carries an Apache 2.0 license and a clear disclaimer: this is not an official Google product and Google provides no support. The project surfaced publicly on October 15, 2026 after a post on X by @jreuben1 linked to capsem.org and described it as a Rust hypervisor sandboxing AI agents in air-gapped Linux VMs.
If you run agents locally today and want hardware-level containment with full audit trails, this is worth tracking. The public launch timeline gives you a few months to evaluate whether it fits your setup before it goes wide.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
