Capsule Security and NVIDIA today revealed they have teamed up to prevent artificial intelligence (AI) agents from going rogue by evaluating an agent’s intent in real time before an action is executed and then applying appropriate controls.
Based on Nemotron, a small language model (SLM) developed by NVIDIA, Capsule Security claims it has achieved 98% accuracy on StepShield, an independent academic benchmark for measuring whether security systems can identify and stop rogue agent behavior before a task is completed.
Capsule Security CEO Naor Paz said Nemotron effectively provides cybersecurity teams with an AI kill switch that can intervene in real time using a platform that enables cybersecurity teams to enforce policies and controls at runtime. It made decisions in as little as 71 milliseconds to operate fast enough within an agentic workflow, the company claims.
That is possible because the NVIDIA Nemotron 3 Ultra can perform a narrowly defined classification task faster than the AI agent is able to invoke a large language model (LLM) to execute a task, said Paz. Capsule Security used its training data along with agent traces, human review and adversarial examples to train the Nemotron model.
In effect, Capsule Security provides an independent control layer for agents as they access sensitive data, write code, operate infrastructure and interact with other systems, he added.
Finally, that approach also serves to reduce the amount of IT infrastructure needed to deploy AI agents because the governance function has been offloaded to the Nemotron SLM, noted Paz.
The pace at which cybersecurity teams are moving to secure agentic AI workflows is unclear, but in the wake of several high-profile incidents involving Hugging Face, Anthropic, OpenAI and Meta awareness of the potential havoc an AI agent can wreak is now significantly higher. The challenge is AI agents are executing tasks at machine speed, so for any control to be effective it needs to be applied in real time before an AI agent completes a task.
That capability is especially critical if end users are invoking LLMs that may have been deliberately trained to add malicious code, said Paz. For example, it’s been shown that certain AI models created in China have been trained to generate additional code that can find its way into an agentic workflow, he added.
Hopefully, organizations will soon become a lot more proactive about securing AI agents. The risk level that AI agents add to any workflow is, after all, substantial. In addition to stealing credentials that provide access to an AI agent, it may not be too long before adversaries inject malicious AI agents into those workflows. Cybersecurity teams will then find themselves responding to a cascading wave of issues that are occurring faster than existing controls are able to effectively thwart.
Unfortunately, if history is any guide there may need to be a few of these types of incidents before business and IT leaders allocate the resources that will inevitably be required to secure AI agents in real time at scale.