Advanced · Safety

Capsem

Visual diagram · (in preparation) · Math · (in preparation) · Worked example · 3 difficulty levels.

TL;DR. A hardware-backed sandboxing approach that runs AI agents inside isolated, capability-limited environments so a compromised agent cannot reach the host system.

Technical Definition

A hardware-backed sandboxing approach that runs AI agents inside isolated, capability-limited environments so a compromised agent cannot reach the host system.

How it works

Capsem — short for capability segmentation — emerged in October 2026 as agentic deployments made 'the model has shell access' a board-level risk. The approach borrows from capability-based security: an agent receives fine-grained, revocable capabilities (read this directory, call this API, spend up to this amount) enforced below the software layer, in hardware-isolated enclaves or micro-VMs. Even if prompt injection fully subverts the agent's reasoning, it can only act within the capabilities it was minted — there is nothing to escalate to. Operationally, Capsem-style deployments pair with session-scoped credentials, egress allowlists, and audit logs of capability use, making the blast radius of a hijacked agent a design constant rather than an incident surprise.

Related Concepts

• Local Decision Models — Compact on-device models — like Google's Gemma 4 and Xiaomi's MiMo-V2.6 — that act as traffic controllers, solving tasks locally and calling cloud APIs only for frontier-level reasoning.
• Agent Harness — Everything surrounding a model that makes it useful in real workflows — the tools, permissions, memory, context, and orchestration around the model itself.
• Agent Memory — Information an agent retains beyond the current context window — episodic history, learned facts, preferences, and task state.
• AI Red Teaming — A structured process of rigorously testing an AI system, often by adversarial attack simulations, to identify vulnerabilities, biases, and potential for misuse.