Agentic artificial intelligence security startup Capsule Security Ltd. today released a detection system built on two Nvidia Corp. Nemotron models it fine-tuned itself, in what it calls an “AI circuit breaker” for rogue AI agents.
The models judge an agent’s intended action in the moment before it executes. Customers can then allow it, flag it or block it in real time. That creates a control layer sitting outside the agent, aimed at the growing number of agents holding credentials to sensitive data, source code or production infrastructure.
Permissions and approval workflows constrain what an agent is allowed to touch. What they cannot do is establish whether a particular action fits the task it was handed, and monitoring after the fact only catches the problem once the damage is done.
On StepShield, an academic benchmark for step-level detection of rogue agent behavior, Capsule said its system reached 98% accuracy and caught violations at the step where they occurred. The benchmark runs monitors against 9,429 code-agent trajectories drawn from real incidents. Its authors argue that accuracy and recall miss the point. One rule-based guardrail they tested caught most rogue trajectories, but more than three-quarters of its alerts fired on benign code written before anything went wrong.
Because the models handle a narrow classification job rather than generate a full response, they can run inside an agent’s workflow without adding much delay. Decisions came back in as little as 71 milliseconds. Capsule’s most accurate detector scored 96.9% on an internal benchmark, against 86% for the strongest third-party model evaluated. Capsule did not identify the third-party model or break out its score. The release said more broadly that the fine-tuned model outperformed frontier systems from OpenAI Group PBC, Anthropic PBC and Google LLC.
Nemotron 3 Ultra, the largest model in Nvidia’s open Nemotron 3 family, supported the training run. Training material included real agent traces and adversarial examples written to mark the boundary of authorized behavior, with humans reviewing the set. Memory requirements on the larger of the two models were cut by close to half without a performance hit, the company said, leaving it able to run on a single Nvidia L40S graphics processing unit.
“The defining AI security risk is no longer only what people can do with agents,” said Naor Paz, co-founder and chief executive of Capsule Security. “It is what autonomous agents can decide to do by themselves. When software can reason, use tools and take action, a wrong decision can become a real-world incident in seconds.”
Billions of tokens across millions of agent interactions already pass through the technology, according to Capsule, whose customers include financial institutions and technology companies. Phillip Miller, vice president and global chief security information officer at H&R Block Inc., said controls of this kind let security teams widen their use of agentic AI. They keep “the security, governance and accountability their clients expect,” he said.
Paz and Lidan Hazout founded Capsule in 2025. The startup launched publicly in April with $7 million in seed funding led by Lama Partners, and disclosed two prompt injection vulnerabilities the same day, one in Microsoft Copilot Studio and one in Salesforce Agentforce. Both have since been patched.
The new capability is available now.
