Capsem is an open-source Rust hypervisor designed to sandbox AI agents in air-gapped Linux VMs. It offers native macOS (Apple Silicon) and Linux packages that boot in under 10 seconds, though platform support is nuanced: the tool requires macOS on M1+ hardware due to Apple's Virtualization.framework, while guest VMs run aarch64 Linux. Its "air-gapped" security model features no direct network access; instead, all traffic routes through a security engine that parses models and MCP sessions via a custom CEL-based DSL to enforce rules. The project's website currently displays placeholders, but the author attributes this to a site redesign underway ahead of an upcoming talk at unpromptedcon.org, noting that core features are stable and documentation has recently been restored. The post sparked discussion about the apparent macOS-versus-Linux contradiction and the site's temporary empty state, but the core technology focuses on Rust-driven virtualization with strict, policy-enforced network isolation.