Capsule Security launches AI 'circuit breaker' using fine-tuned Nvidia Nemotron models

The system judges an agent’s intended action before the agent executes it, allowing customers to approve, flag or block the action in real time. This creates a control layer outside the agent, aimed at agents that hold credentials to sensitive data, source code or production infrastructure. Traditional permissions and approval workflows can limit what an agent can touch, but they cannot determine whether a specific action fits the task the agent was given. Monitoring after the fact catches problems only after damage has occurred.

Capsule said its system reached 98% accuracy on StepShield, an academic benchmark for step-level detection of rogue agent behavior, and caught violations at the step where they occurred. The benchmark runs monitors against 9,429 code-agent trajectories drawn from real incidents. Its authors argue that accuracy and recall miss the point; one rule-based guardrail they tested caught most rogue trajectories but fired more than three-quarters of its alerts on benign code written before anything went wrong.

Because the models handle a narrow classification job instead of generating a full response, they run inside an agent’s workflow without adding much delay. Decisions came back in as little as 71 milliseconds. Capsule’s most accurate detector scored 96.9% on an internal benchmark, compared with 86% for the strongest third-party model evaluated. Capsule did not identify the third-party model or break out its score. The release said more broadly that the fine-tuned model outperformed frontier systems from OpenAI Group PBC, Anthropic PBC and Google LLC.

The training run used Nemotron 3 Ultra, the largest model in Nvidia’s open Nemotron 3 family. Training material included real agent traces and adversarial examples written to mark the boundary of authorized behavior, with humans reviewing the set. Capsule said memory requirements on the larger of the two models were cut by close to half without a performance hit, leaving it able to run on a single Nvidia L40S graphics processing unit.

“The defining AI security risk is no longer only what people can do with agents. It is what autonomous agents can decide to do by themselves,” said Naor Paz, co-founder and chief executive of Capsule Security. “When software can reason, use tools and take action, a wrong decision can become a real-world incident in seconds.”

According to Capsule, billions of tokens across millions of agent interactions already pass through the technology. Customers include financial institutions and technology companies. Phillip Miller, vice president and global chief security information officer at H&R Block Inc., said controls of this kind let security teams widen their use of agentic AI while keeping “the security, governance, and accountability their clients expect.”

Paz and Lidan Hazout founded Capsule in 2025. The startup launched publicly in April with $7 million in seed funding led by Lama Partners, and disclosed two prompt injection vulnerabilities the same day, one in Microsoft Copilot Studio and one in Salesforce Agentforce. Both have since been patched. The new capability is available now.