Capsule puts a 71-millisecond blocking decision between an AI agent and its tool call
Capsule Security has shipped an evaluator that runs inside an agent's execution path and can stop an intended action before it executes. Doing that requires adding a chokepoint to the agent's execution path.
The Watch · Security desk
What happened
- Capsule Security, founded in 2025 by Naor Paz and Lidan Hazout, announced its 'AI circuit breaker' on September 2, 2026.
- The product runs an evaluator inside the agent's execution path, judging an intended action immediately before execution so operators can allow, flag or block it in real time.
- Decisions return in as little as 71 milliseconds, and the technology runs on a single Nvidia L40S GPU after Capsule cut the larger model's memory requirement by almost half.
- On StepShield, an academic benchmark for catching rogue agent behavior before damage, Capsule reports 98 percent at the step where the violation occurs.
Why it matters
- Who's exposed exposure A 98 percent step-level score means one violating step in 50 executes, and the miss lands on a real tool call rather than a log entry, so exposure scales with how many calls an agent makes per shift.
- What it limits constraint With no published false-positive rate, a buyer cannot size how often block mode would stop legitimate work, which pushes first deployments toward flag-only settings where nothing is actually interrupted.
- Who has to decide decision The control turns an agent authorization question into a per-workflow latency budget, and that is a number the engineering owner of the agent decides, not the governance program.
- What doesn't add up contradiction SecurityWeek reports only a margin over the strongest third-party model evaluated, while SC World, citing Silicon Angle, names OpenAI, Anthropic and Google, so the comparison set a buyer is being sold on is unsettled.
Next story · Product · 21h ago
Perplexity open-sources SPACE, an agent sandbox it says held through 118 escape attemptsConfirmed2 publishers
Twenty tool calls in a chain, at 71 milliseconds each, add 1.42 seconds of wall clock [16]. That arithmetic is why this is a small-model product. Capsule's own framing is that reviewing agent behavior before it happens commonly costs too much latency to be usable, and that post-incident monitoring only finds the problem after the damage [12]. Two fine-tuned classifiers doing one narrow job, trained on real agent traces, human review and adversarial examples [4], fit inside the loop in a way a general-purpose reviewer called on every step could not.
The install is the harder half. The evaluator has to see the intended action before the runtime executes it [2], which means the agent's tool calls have to pass through something that sits outside the agent [5]. Where an agent invokes its tools in-process, through SDK calls in the same program, there is no seam to insert a veto at. Creating one is application work, and it lands on whoever owns the agent rather than on the committee that wrote the AI usage policy.
On accuracy, everything published so far is Capsule's own measurement. The claimed margin over the strongest third-party model it evaluated is 10.9 points [18]. Read as misses, that is 3.1 percent of rogue steps getting through against 14 percent, about a 4.5x difference in what reaches the tool [19]. SC World, citing Silicon Angle, says the fine-tuned model outperformed frontier systems from OpenAI, Anthropic and Google [20]. Neither account publishes a false-positive rate [17], and for a control whose action is "block", precision is what decides whether it stays in blocking mode after the first week.
The category is arriving alongside the exposure. SecurityWeek's related coverage lists an agent firewall startup out of stealth with $50 million, a product that adds a human check to risky agent actions, and a UK government agentic AI defense plan [13]. It also lists a critical vulnerability exposing GitHub agentic workflows to prompt injection [14]. That last one is the attacker path this class of product is aimed at: the agent is authorized and the tool call is well-formed; the only place left to catch the instruction that came from poisoned content is between the reasoning and the execution [2].
Paz puts the risk as what autonomous agents can decide to do by themselves [15]. Acting on that is plumbing before it is procurement: every agent tool call routed through one broker the security team owns, and the runtime patched to wait for its answer.
What to watch
- An independent reproduction of Capsule's StepShield and detection numbers on a published harness, run by someone other than Capsule.
- Whether any named customer discloses running the circuit breaker in block mode rather than flag-only.
- Whether agent frameworks add a native interception hook for external evaluators, which would remove the integration work from the buyer.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption15
- Hype gap+35
- Incentives75
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Capsule claims 98% for the circuit breaker's decision maker against StepShield, described by SecurityWeek as an independent academic benchmark measuring whether security systems identify and stop rogue agent behavior before damage occurs; SC World describes it as 98% accuracy in detecting violations at the step they occurred.
- [2]
Capsule's evaluator runs within the agent's execution path, evaluates the agent's intended action immediately prior to execution, and can stop it before execution.
- [3]
The models can return a decision in as little as 71 milliseconds, operating within the agent's workflow without meaningful delay.
- [4]
Capsule used NVIDIA Nemotron 3 Ultra to support training and built two fine-tuned Nemotron models, combining real agent traces, human review and adversarial examples designed to teach the boundary between authorized and rogue behavior.
- [5]
The model evaluates an agent's intended action immediately prior to execution, giving organizations the ability to allow, flag or block it in real time, creating an independent control layer outside the agent for agents that can access sensitive data, write code, operate infrastructure and interact with other systems.
- [6]
Capsule Security was founded in 2025 by Naor Paz (CEO) and Lidan Hazout (CTO), and announced its 'AI circuit breaker' on September 2, 2026.
- [7]
Capsule's more accurate model attained 96.9% detection accuracy, compared with 86% for the strongest third-party model evaluated.
- [8]
Capsule reduced the infrastructure for its larger model, cutting its memory requirement by almost 50%.
- [9]
At 98 percent step-level accuracy, one violating step in every 50 is not caught and executes.
- [10]
The technology can run on a single Nvidia L40S GPU.
- [11]
Capsule's customers include financial institutions and technology companies.
- [12]
Capsule's stated problem framing: reviewing an agent's behavior before it happens commonly introduces latency that may be too slow and too expensive, and post-incident monitoring only identifies the problem after the damage has occurred.
- [13]
SecurityWeek's related coverage lists AI Agent Firewall startup AIR Security emerging from stealth with $50 million, OpenLeash adding a human check to risky AI agent actions, and the UK Government rolling out an agentic AI defense plan alongside an industry pledge.
- [14]
SecurityWeek's related coverage includes a critical vulnerability exposing GitHub agentic workflows to prompt injection.
- [15]
Paz: 'The defining AI security risk is no longer only what people can do with agents. It is what autonomous agents can decide to do by themselves.'
- [16]
A twenty-step agent chain evaluated at 71 milliseconds per step adds 1.42 seconds of latency.
- [17]
Neither the SecurityWeek nor the SC World account reports a false-positive rate or precision figure for Capsule's models.
- [18]
The claimed margin between Capsule's more accurate model and the strongest third-party model it evaluated is 10.9 percentage points.
- [19]
Stated as misses, Capsule's model lets 3.1 percent of rogue steps through against 14 percent for the strongest third-party model evaluated, a factor of about 4.5.
- [20]
SC World, citing Silicon Angle, reports that Capsule's fine-tuned model outperformed frontier systems from OpenAI, Anthropic and Google.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comCapsule Security unveils 'AI circuit breaker' to control rogue AI agents
1 article · September 3, 2026
- securityweek.comCapsule Security Launches ‘AI Circuit Breaker’ to Stop Rogue Agents
1 article · September 3, 2026
Topics and entities
Entities
- NVIDIA Nemotron
- Capsule Security Ltd.
- Nvidia
- NVIDIA L40S