Capsem 2026 setup guide: sandbox Claude Code, Gemini CLI and Codex in isolated VMs

Summary. On 1 July 2026 The Hacker News reported two Cursor vulnerabilities, CVE-2026-50548 and CVE-2026-50549, both rated 9.8 out of 10, that let a single injected prompt switch off the editor's own sandbox and run arbitrary commands on a developer machine. Cato AI Labs named the pair DuneSlide; the fix shipped in Cursor 3.0 on 2 April 2026, and every earlier version is affected. The Hacker News places it as the latest in a run of Cursor bugs that began in August 2025, each one defeating a different guardrail. Capsem takes the boundary somewhere harder to argue with: a hardware-isolated Linux VM per agent session, booting to a prompt in under 10 seconds, with all guest HTTPS traffic terminated and inspected on the host. It runs on macOS 14 or later on Apple Silicon, and on Debian or Ubuntu with KVM. The stakes are not theoretical for Indian teams either, where the DPDP Act 2023 carries a maximum penalty of ₹250 crore, roughly $30 million, for failing to take reasonable security safeguards.

The OWASP GenAI Security Project makes the shape of the problem plain. Of 53 agentic projects it tracks in its 2026 report, 28 are coding agents, and the five fastest-growing tools in that set are Claude Code, Gemini CLI, Codex, Cline and Aider. Claude Code alone carries 22 security advisories, second only to the workflow platform n8n at 57.

This guide covers what Capsem actually is, who publishes it, how the isolation and traffic inspection work, where it fits against Docker and the editors' built-in sandboxes, and what it does not fix.

What Capsem is, and who publishes it

Capsem is a Rust hypervisor that sandboxes AI coding agents in hardware-isolated Linux VMs. Each session boots a fresh lightweight VM with a read-only rootfs, no swap, no kernel modules and no debugfs. There is no systemd, no sshd and no cron inside the guest. Networking is air-gapped by design: a dummy NIC and fake DNS mean nothing reaches the real network except through an inspecting proxy running on the host.

One correction worth making early, because several launch roundups got it wrong. The repository lives at github.com/google/capsem, and that address has led a number of write-ups to describe Capsem as Google's official agent sandbox. The README says otherwise, in plain terms: "This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose." The project site carries the footer "© 2026 Elie Bursztein. Open source under MIT license." Treat it as a well-built open-source project from a senior security researcher, published under a Google organisation account, and plan support expectations accordingly.

The maturity signals point the same way. As of 20 July 2026 the GitHub repository shows 65 stars, 9 forks and 104 open issues, with the documentation site describing release 0.15. VM checkpointing and restore, Linux host support, a VS Code extension and a custom MCP server marketplace are all listed as coming soon. That is early software solving a real problem, not a finished enterprise product.

Why the editor's own sandbox was not enough

Cursor added a sandbox to its 2.x line so that terminal commands issued by the agent ran inside a restricted box. DuneSlide is the story of getting out of it, and both flaws work the same way: get the agent to write one file it should not be able to write, then use that write to turn the sandbox off.

CVE-2026-50548 abuses a parameter. The sandbox allows writes into a command's working folder, and that folder is an optional working_directory argument on Cursor's run_terminal_cmd tool. When the agent sets it to a non-default path, Cursor adds that path to the allowed-write list without further checks. Injected instructions point it at a system file instead of the project, overwrite the sandbox helper binary itself, and every later command runs unsandboxed. Startup files such as ~/.zshrc work as targets too.

CVE-2026-50549 abuses a safety check. Cursor resolves symlinks before writing to confirm the real destination sits inside the project. The bug is in the fallback: when that resolution fails, because the target does not exist or an attacker removes read access from a folder in the path, Cursor trusts the symlink's in-project path instead and writes straight through it.

Neither needs a click or an approval box. The attacker plants instructions in something the agent reads for you, such as a connected MCP service or a page returned by a web search. The disclosure timeline is its own lesson: Cato reported both issues on 19 February 2026, Cursor rejected them four days later on the grounds that its threat model did not cover misuse of MCP servers, Cato escalated on 26 February, and the CVE IDs were assigned on 5 June.

This is a pattern, not an incident. CurXecute (CVE-2025-54135, August 2025) rewrote Cursor's MCP config from a planted Slack message and ran commands even after the user rejected the edit. MCPoison (CVE-2025-54136), from Check Point Research, let an attacker get an MCP config approved once and then swap in malicious commands with no second prompt. CVE-2026-26268 in February 2026 hid a booby-trapped Git hook that fired when the agent ran a Git command. Against OpenAI's Codex CLI, CVE-2025-59532 showed the agent's own output could redefine the boundary of its sandbox.

Where each layer breaks

The pattern is that every bypass above lives inside the same trust domain as the agent. Move the boundary to the hypervisor and the class of attack changes from "rewrite the thing that restricts me" to "escape a VM", which is a materially harder problem.

How the isolation works

On macOS, Capsem uses Apple Virtualization.framework to create the guest. On Linux it uses KVM. The agent runs inside that guest; the desktop app, the proxy, the policy engine and the telemetry database all stay on the host. The two sides talk over vsock rather than a network: port 5001 carries terminal I/O, port 5002 carries HTTPS and MCP traffic.

The network path is the interesting part. Inside the guest, an iptables rule redirects HTTPS to a local TCP-to-vsock relay. The host terminates TLS using per-domain certificates minted by a static Capsem CA that is baked into the guest's trust store, inspects the HTTP request, applies policy, and only then forwards to the real upstream. Full request and response bodies are written to a per-session SQLite database. In practice that gives you something most teams have never had: a complete, queryable record of every network call an agent made during a task, available for review after the fact rather than as a live approval prompt nobody reads.

Policy is layered. Each profile owns its enforcement rules, written in CEL, along with detection rules that import and export in Sigma format, MCP configuration, plugins and assets. Above that sits a corp-level file at /etc/capsem/corp.toml, intended for MDM distribution, which locks policy and reporting with enterprise overrides that users cannot bypass. That layering is what makes it plausible as a fleet control rather than a personal tool.

Install is a single command:

            curl -fsSL https://capsem.org/install.sh | sh
          

Pre-built DMG, .deb and .AppImage packages are available from the releases page for teams that would rather not pipe a script into a shell, which is the right instinct for a security tool. First runs are ordinary:

            capsem uname -a
capsem echo hello
capsem 'ls -la /proc/cpuinfo'
          

The guest image is preconfigured rather than bare. Python 3, Node.js 24, git and uv are installed, along with roughly thirty packages including numpy, pandas, scipy, scikit-learn, requests, httpx, beautifulsoup4, pytest, rich, matplotlib and fastmcp. Claude Code, Gemini CLI and Codex are pre-installed and auto-configured for sandbox mode. Capsem also exposes a native MCP endpoint over vsock with policy-checked built-in tools: fetch_http, grep_http and http_headers, plus custom servers via fastmcp.

Capsem against the usual alternatives

The honest trade-off is that a container is faster to adopt, already in most teams' toolchain, and shares the host kernel. Capsem gives a stronger boundary and real traffic inspection, and asks you to run a hypervisor per session on developer laptops.

What a VM does not fix

Isolation limits the blast radius. It does not stop the model from following hostile instructions, and no honest guide should suggest otherwise.

The architectural root cause is unchanged. Large language models treat the system prompt, the user's request and any retrieved text as one stream of tokens, with no reliable way to mark some as commands and others as data. OWASP maps prompt injection to six of the ten categories in its Top 10 for Agentic Applications.

Simon Willison, who coined the term prompt injection and writes about it at length on his weblog, put the state of play bluntly in his lethal trifecta post: "Here's the really bad news: we still don't know how to 100% reliably prevent this from happening." His framework is the one to plan around. An agent with access to private data, exposure to untrusted content and the ability to communicate externally can be turned into an exfiltration tool by one injected prompt. Hold any two and you are broadly safe; hold all three in one session and you are exposed. Meta's Agents Rule of Two treats the same three properties as a budget: an agent acting without human approval gets two of the three, and all three requires a human in the loop.

Capsem attacks the third leg. The MITM proxy and per-domain policy mean external communication is constrained and recorded rather than open. It does nothing about the first two. If your agent session has your production credentials mounted and reads a poisoned GitHub issue, the VM has contained the damage to what that session could reach, which may still be plenty. Pair the isolation with credential hygiene; our guide on keeping agent credentials out of the model's reach covers that side, and the broader control set is in our piece on stopping prompt injection before agents act.

The supply chain deserves a mention because it bypasses the agent entirely. A backdoored version of LiteLLM sat on PyPI for three hours in March 2026 and was downloaded nearly 47,000 times; LiteLLM is the model gateway for CrewAI, DSPy, Microsoft GraphRAG and others. A malicious MCP server called postmark-mcp shipped fifteen clean versions to build legitimacy before adding a single line of exfiltration code. An ephemeral VM with a read-only rootfs helps here, because the compromise does not persist between sessions.

A rollout that survives contact with a real team

Start with the sessions that already worry you rather than the whole fleet. The agents doing unattended multi-step work on repositories with production access are worth isolating first; a developer using inline completion in a scratch project is not.

Second, decide what the proxy log is for before you turn it on. A per-session SQLite database of full request and response bodies is a security control and a data-retention question at the same time. Someone needs to own where those files live, who reads them and how long they are kept, particularly if the sessions touch personal data.

Third, write the corp policy before handing laptops out. The /etc/capsem/corp.toml layer only helps if the domain and MCP rules in it reflect what your engineers actually need to reach. A policy so tight that developers work around it is worse than no policy, because it moves the work somewhere with no logging at all.

Fourth, treat the platform caveat seriously. The requirements say macOS 14 or later on Apple Silicon, or Debian or Ubuntu with KVM, while the feature list still shows Linux host support as coming soon. Those two statements sit uneasily together. If your fleet is mostly Linux, pilot before you commit, and check the current release notes rather than trusting this paragraph in six months.

Fifth, keep the editors patched regardless. Isolation is a second layer, not a replacement for shipping Cursor 3.0 or later. Teams running parallel agents will find the workflow patterns in our parallel agents and worktrees guide useful alongside the isolation work, and anyone wiring agents to event triggers should read our notes on event-triggered coding agents first, because automation removes the human who would otherwise notice something odd.

India-specific considerations

For teams building in India, the logging that Capsem produces maps directly onto a compliance obligation rather than sitting as a nice-to-have.

The DPDP Act 2023 sets a maximum penalty of ₹250 crore for failure to take reasonable security safeguards where that failure leads to a personal data breach, with a separate exposure of ₹200 crore for notification failures, and the two can stack on a single incident. The DPDP Rules 2025 require that safeguards cover all stages of processing, with access logs, traffic data and processing logs retained for at least one year. An agent that can read a customer database and make outbound HTTP calls is squarely inside that scope, and a per-session record of exactly which endpoints it contacted is the kind of evidence a Data Protection Board enquiry will ask for.

The timeline matters for planning, and the DPDP Act and Rules 2025 guide sets it out. Phase 1 took effect on 13 November 2025 with the establishment of the Data Protection Board, the consent manager registration framework activates on 13 November 2026, and full compliance with substantive obligations including breach notification lands on 13 May 2027. Our breakdown of what DPDP compliance actually costs Indian startups before the 2027 deadline has the wider picture.

There is a second, blunter reason to care. Regulators elsewhere are counting in hours, not months: DORA allows four hours to notify a major incident and NIS2 requires a 24-hour early warning. If an Indian services firm is delivering for European clients, the client's clock becomes the firm's clock. You cannot report inside four hours on an incident you have no logs for.

One more number worth sitting with. According to IBM data cited in the OWASP report, only 37% of organisations have a policy in place to detect shadow AI. Most teams do not know which agents are running against which repositories today. Isolation is the second problem; inventory is the first.

FAQ

How eCorpIT can help

eCorpIT builds and secures agent workflows for teams that have moved past pilots and now have AI agents touching real repositories and real customer data. Our senior engineering teams handle the parts that decide whether isolation holds up: session policy design, credential separation, proxy log retention that meets DPDP obligations, and MDM rollout across a mixed macOS and Linux fleet. We work with the tools you already run rather than replacing them. If you want a review of how your coding agents are currently sandboxed, contact us and we will start with an inventory.

References

1. Capsem project site — architecture, requirements, guest image contents and policy layers.

1. google/capsem README on GitHub — install instructions and the disclaimer of official Google support.

1. Capsem releases — packaged builds for macOS and Linux.

1. Capsem documentation — getting started, architecture and security references.

1. Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands — The Hacker News, 1 July 2026, on DuneSlide.

1. DuneSlide: two critical RCE vulnerabilities — Cato AI Labs research disclosure.

1. NVD record for CVE-2026-50549 — National Vulnerability Database.

1. Cursor security advisory GHSA-3v8f-48vw-3mjx — vendor advisory for the symlink bug.

1. Prompt injection still drives most agentic AI security failures in production — Help Net Security, 11 June 2026.

1. OWASP GenAI Security Project: State of Agentic AI Security and Governance — the underlying report.

1. The lethal trifecta for AI agents — Simon Willison, 16 June 2025.

1. Practical AI agent security: the Agents Rule of Two — Meta AI.

1. Penalties and adjudication under India's DPDP Act, 2023 — penalty bands including the ₹250 crore maximum.

1. Sandbox bypass flaws in Cursor IDE highlight prompt injection as an RCE vector — CSO Online.

1. India data privacy laws: DPDP Act 2023 and DPDP Rules 2025 — phased enforcement dates and log retention requirements.

Last updated: 20 July 2026.