Claura Open the prototype

Seal the breach
before it spreads.

When an AI workload tries to escape its VM, Claura’s defender agents seal it off like a ship’s bulkhead.

Watch the demo Open the prototype

60,000 sandboxed agents. One of them breaks out.

A guest-to-host escape through the vGPU path puts its neighbours and the management plane within reach.

A static playbook has never seen it.

Playbooks only match attacks they have already seen. This one is new.

The on-call engineer is asleep.

Every minute spent waking someone, finding the host and deciding what to cut is a minute the breach spends spreading.

Four agents. One human.

Each agent has one job. The one high-impact step stays with a person.

  1. Sentry spots the escape.

    It correlates IOMMU faults, hypervisor audit logs, host EDR, IPMI flows and token misuse into a single incident.

  2. Triage sizes the blast radius.

    One suspect host, 11 co-resident guests and a reachable management plane. Triage scores what the escape could touch before anything moves.

  3. Warden seals it, reversible steps first.

    Cut the network, revoke credentials, cordon the host. Then pause the guest, capture its memory and fail the guests over to clean hosts.

    Reversible first

    1. Isolate network
    2. Revoke credentials
    3. Cordon host

    Then

    1. Pause guest
    2. Capture memory
    3. Fail over guests

    Quarantine host waits for a person

  4. Scribe writes the timeline.

    A forensic record of every signal, action and approval, kept while the others work.

    1. SentryEscape suspected on the vGPU path
    2. Triage1 host, 11 guests, management plane reachable
    3. WardenNetwork isolated
    4. Warden11 guests failed over to clean hosts
    5. OperatorQuarantine approved with ⌘↵
    6. WardenHost quarantined, incident contained

  5. You make the one call.

    Quarantining the host is the single high-impact step. Evidence, scope and rollback sit on one card. Approve with ⌘↵. Tap to approve.

    Quarantine host b14-gpu-07

    Proposed by Warden · policy-bounded

    Needs approval

    Warden: qemu on this host spawned a shell after a DMA fault. Treat the host as untrusted until it is reimaged.

    Evidence
    6 correlated signals: IOMMU fault, vGPU mdev fault, VMM ioctl, qemu → /bin/sh, IPMI flow, token misuse
    Scope
    1 host · 11 guests failed over
    Rollback
    Un-quarantine restores the host to the pool

    Warden cannot quarantine a host on its own.

Contained

0 co-resident guests affected. Six automated steps, one approval, one sealed host.

  1. Isolate
  2. Revoke
  3. Cordon
  4. Pause
  5. Memory
  6. Failover
  7. Approval
  8. Contained

Agents propose. Policy decides.

Defender agents reason with NVIDIA Nemotron, self-hosted on-prem, so telemetry stays in the building. Every proposed action passes a policy gate before anything runs.

Planned architecture

Static SOAR playbooks

Match attacks they have already seen, then run fixed steps.

Claura’s agents

Assemble evidence on attacks nobody has seen and propose bounded actions. Policy, not the model, decides what executes.