MOUNTAIN THEORY VS CAPSULE SECURITY
Capsule left stealth in April 2026 with an open-source pre-invocation checkpoint and real zero-day research behind it. Closest to Mountain Theory in approach, earliest in maturity.
| Capsule Security | Mountain Theory | |
|---|---|---|
| What it controls | Agent intent before a tool call | The action an AI agent is about to take |
| Where it sits | Pre-invocation checkpoint | Inline at execution, between the decision and the action |
| How policy is set | Open-source rule config | Plain English, no code |
| Deployment reach | ClawGuard, developer-oriented | Model and framework agnostic, including custom and on-prem agents |
| Best fit when | You want a free developer checkpoint | An AI acting wrongly has physical or regulatory consequences |
Why you might pick Capsule Security
Their open-source ClawGuard checkpoint lowers adoption friction considerably, and two named vulnerabilities, ShareLeak in Microsoft Copilot Studio and PipeLeak in Salesforce Agentforce, give them real threat-research credibility from day one. The founding team came out of F5, Unit 8200 and Transmit Security.
Why you might pick Mountain Theory
Capsule is a single open-source checkpoint that assesses agent intent before tool execution. Mountain Theory is full enterprise infrastructure: plain-English policy, an identity and session layer at the action level, and bidirectional inspection rather than a pre-invocation-only check.
The honest verdict
ClawGuard is a good free checkpoint and a sensible way for a developer team to start. It checks intent before a tool call and it is open source, which means someone on your team owns it. When you need policy written by the person who carries the risk rather than the person who writes Python, an identity layer at the action level, and something an auditor accepts as evidence, a checkpoint is not yet a control plane.
What we can actually show
Claims in this category are easy to make and hard to check, so here is ours on the record. The same 10 actions were run in the same order under three configurations. Ungoverned, 10 of 10 executed. Under NVIDIA OpenShell alone, all 5 sandbox-boundary crossings were denied at the kernel, and all 3 in-bounds bad decisions still went through, including a secrets read that printed credentials to the screen. Under OpenShell plus Mountain Theory, those same 3 actions returned HOLD, HOLD and BLOCK, and the secrets read was stopped before it executed, so the credentials never printed. Terminal recordings of all three runs are published, including the two actions Mountain Theory has no policy for.
Separately, when a third-party provider updated the foundation model driving an autonomous agent, the agent began attempting multi-step actions it had never tried before. Nothing on our side changed. Every attempt was stopped on 30 and 31 July 2026, the days the behaviour first appeared. No new rule, no signature, no patch.
Watch the three-configuration run against NVIDIA OpenShell
See novel agent behaviour stopped the day it appeared
Ask Capsule Security, and every other vendor you are evaluating, for the same four things: the exact action set, the ungoverned control condition, the outcome per action including the ones the product did not stop, and the recording. A certification, an integration list or a customer logo answers a different question.
Compare all 56 AI security vendors