Capsem is a new open-source project that runs AI coding agents (Claude Code, Codex, Gemini CLI) inside ephemeral, air-gapped Linux VMs and forces their HTTPS traffic through an inspecting proxy. It is a real approach to the question "what can my agent reach?", but its public pages disagree on how finished it is. This post summarizes what Capsem's site and GitHub repository say, flags the gaps, and explains where it fits next to Beam.
TL;DR
| Question | Answer |
|---|---|
| What does it do? | Boots each agent session in a short-lived Linux VM, with network traffic proxied and logged on the host. |
| Is it ready? | Unclear. The site shows an install script; the README says 0.6 is a pre-release with install and packages withheld until a public release. |
| Does data leave my machine? | The site describes a local proxy and per-session SQLite logs. The agent's own traffic to its model provider still goes out, through the proxy. |
| Does it replace Beam? | No. Different layer: isolation versus observation and policy on the host. |
How Capsem sandboxes an agent
Per the site, each session works like this:
- A lightweight VM boots with a read-only root filesystem and a tmpfs workspace, with no swap, kernel modules, systemd, sshd or cron.
- The guest gets a dummy network interface and fake DNS, so it cannot reach the network directly.
- All HTTPS goes to a proxy on the host that terminates TLS, inspects each request, applies policy and forwards it upstream.
- Full request and response bodies are written to a per-session SQLite database.
- Policy is per profile, and an optional
/etc/capsem/corp.tomlcan lock settings so users cannot override them.
It also ships an MCP endpoint with built-in tools (fetch_http, grep_http, http_headers), detection rules with Sigma import and export, and claims boot to prompt in under 10 seconds. Supported hosts are macOS 14+ on Apple Silicon and, per the README, Ubuntu 24.04+ or Debian 13+ with KVM.
What is unclear
Treat these as open questions, not defects we have confirmed:
- Release status. The README says Capsem 0.6 is undergoing release qualification, with installation and packages "intentionally unavailable until the public release, planned for Summer 2026". The site, in October, shows a
curl | shinstaller. - Who is behind it. The repository sits under a
googleGitHub organization, yet its README states it is not an official Google project and is unsupported by Google. - Platform and license details. The site lists Linux support in one place and "coming soon" in another, and the license reads differently on the site (MIT) and the repo page (Apache-2.0).
- "Air-gapped." One Hacker News commenter (ducktective) asked how it is air-gapped; from the site, the answer appears to be no direct network, with a policy-controlled proxy as the only path. Another commenter (lasiotus) pointed to the conflicting platform statements, and a third (lol8675309) criticized placeholder screenshots on the page.
- Proxy trust. A TLS-terminating proxy sees plaintext including tokens, so the logs it writes are sensitive. Check where they live and who can read them.
What this means if you run AI coding agents
- Isolation and observation answer different questions. A VM limits what a hijacked agent can reach. It does not tell you whether the agent was manipulated or what it tried. See our monitor versus block comparison.
- Sandboxes fail too. Read the Perplexity sandbox escape red-team write-up before treating any boundary as absolute.
- Anything you mount or forward is in scope. Credentials, SSH agents and repos you expose inside the VM are what an attacker gets.
- Before adopting, verify: the release you are installing, the license, where proxy logs go, and which hosts are allowed by default.
What Beam can and cannot do here
Beam is not a sandbox. It runs on your machine, watches what Claude Code, Codex and similar agents do, flags risky actions such as credential exposure and destructive commands, and scans skills and MCP configs with 11 heuristics plus a version-pin check, keeping data on-device with redaction before storage (how it works). It can deny through Claude Code and Codex PreToolUse hooks; that is hook-based, not a kernel boundary, and heuristic. It fails open if cached policy is missing. For stopping dangerous commands in Claude Code, Beam's hook is the relevant piece; a VM like Capsem would be an additional, separate layer. We have not tested Capsem alongside Beam, so we make no claim about running them together. For the broader picture see what agent harnesses are.
Frequently asked questions
What is Capsem?
An open-source Rust hypervisor that runs each coding agent in an ephemeral Linux VM with a read-only root and no direct network, inspecting HTTPS through a host proxy.
Which agents does Capsem support?
Claude Code, Gemini CLI and Codex are listed as pre-installed, plus an MCP endpoint and custom MCP servers.
Is Capsem ready to install?
Its pages conflict: a site install script versus a README calling 0.6 a pre-release. Check current release status first.
Is Capsem a replacement for Beam?
No. Capsem isolates where an agent runs; Beam observes and flags what agents do on your machine and can deny through hooks.
Does a VM sandbox stop prompt injection?
It limits the blast radius but does not stop an agent from being manipulated or from misusing what you expose inside the VM.
Related reading
- Introducing Beam: local-first AI agent security
- AI agent security: monitor vs block
- Perplexity sandbox escape red-team
- Sources: Capsem, google/capsem on GitHub
This post reflects Capsem's public pages and Beam's documented features as of October 15, 2026. Capsem is moving quickly and its pages were inconsistent when we read them; verify details against the current release.