Agent Hypervisor vs CaMeL

Agent Hypervisor vs CaMeL

CaMeL is a capability-based defense for LLM agents that uses information-flow control and an external protective layer. Agent Hypervisor shares some of that motivation, but differs on where intelligence is allowed to operate.

Core Distinction

Feature	CaMeL	Agent Hypervisor
LLM role	Extracts control flow at runtime	Helps author deterministic artifacts at design time
Enforcement path	LLM remains part of the critical path	Runtime enforcement is static and deterministic
Policy scope	Per-query execution	Workflow and world bounds via World Manifest
Cross-session taint	Not the primary structural focus	Provenance and taint persist across session boundaries

Agent Hypervisor Claim

Runtime security boundaries should not rely on probabilistic interpretation. Agent Hypervisor uses LLMs to help define the world, then relies on compiled manifest artifacts to enforce that world.

See also

• AI Aikido
• World Manifest
• ZombieAgent Scenario