ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation

• URL: http://arxiv.org/abs/2605.26542v1
• Date: Tue, 26 May 2026 04:44:59 GMT
• Title: ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation
• Abstract summary: We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers.<n>On 82 tasks across five frontier models from three providers, ChainCaps reduces attack success rate from 25-68% to 0-4.8%.<n>Our claims are limited to explicit-flow composition safety under trusted manifests and proxy-visible data movement.
• Score: 11.138472843474505
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Tool-using agents increasingly operate in open-ended deployment environments, where they compose file systems, web APIs, code interpreters, and enterprise services at runtime. This creates a safety gap in tool composition: an agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect, such as reading a confidential document, summarizing it, and sending the summary to an external endpoint. We call this failure mode permission laundering. ChainCaps addresses it with a runtime rule: every value carries a sink-specific capability budget, and tool composition propagates budgets by intersection. A value can preserve or lose authority as it moves through a tool chain, but it cannot gain new authority through composition. We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers. On 82 tasks across five frontier models from three providers, ChainCaps reduces attack success rate from 25-68% to 0-4.8% while preserving 96-100% benign completion. In replay experiments, it also outperforms scalar-IFC and per-function-isolation baselines. Manifest quality is the dominant deployment bottleneck: expert manifests reach 100% attack blocking, while naive manifests fall to 27.3%. Our claims are limited to explicit-flow composition safety under trusted manifests and proxy-visible data movement, a practical gap in deployed tool-using agents today.

Related papers

• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents [1.8734449181723825]
  W3C WebMCP proposal enables LLM agents to invoke tools exposed by web pages.<n>In multi-party web environments, integrating agent execution into a browser security model leaves insufficient provenance and lifecycle guarantees for agent-accessible tools.<n>We propose WebMCP-Phalanx, a dual-layer agent runtime architecture.
  arXiv  Detail & Related papers  (2026-08-25T03:16:45Z)
• AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems [7.734540679538682]
  LLM agents increasingly read untrusted content, invoke external tools, access private data, and delegate work to other agents.<n>We present AgentFlow, a flow-centric policy language and runtime enforcement model for specifying where data may travel in agent systems.
  arXiv  Detail & Related papers  (2026-08-24T06:56:00Z)
• ToolGuardian: Declarative Security for AI Agent-Tool Interactions [0.0]
  Existing defenses rely on weak metadata, collapse characterization and policy judgment.<n>This paper presents ToolGuardian, a policy-driven framework for securing agent-tool interactions.
  arXiv  Detail & Related papers  (2026-07-23T21:53:34Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck [18.14752683836217]
  textscPACT is a runtime monitor that assigns semantic roles to tool arguments.<n>textscPACT reframes agent security as authority binding.
  arXiv  Detail & Related papers  (2026-05-11T04:09:11Z)
• AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use [2.9991161518367875]
  AgentTrust intercepts agent tool calls before execution and returns a structured verdict: allow, warn, block, or review.<n>We release a 300-scenario benchmark across six risk categories and an additional 630 independently constructed real-world adversarial scenarios.<n>On the 630-second benchmark, evaluated under a patched ruleset, AgentTrust achieves 96.7% verdict accuracy, including about 93% on shell-obfuscated payloads.
  arXiv  Detail & Related papers  (2026-05-06T11:38:16Z)
• ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems [56.613157564882925]
  Malicious behaviors are embedded in seemingly benign tools, silently hijacking agent execution, leaking sensitive data, or triggering unauthorized actions.<n>Despite their growing impact, there is currently no comprehensive benchmark for evaluating such threats.<n>We propose ShieldNet, a network-level guardrail framework that detects supply-chain poisoning by observing real network interactions.
  arXiv  Detail & Related papers  (2026-04-06T05:15:00Z)
• Governing Dynamic Capabilities: Cryptographic Binding and Reproducibility Verification for AI Agent Tool Use [0.0]
  No existing security layer verifies what an AI agent can do, whether it executed what it claims, or what happened in a multi-agent interaction.<n>Existing frameworks conflate the two, enabling silent capability escalation and leaving interactions without verifiable provenance.<n>We derive three Agent Governance Requirements: capability integrity (G1), behavioral verifiability (G2), and interaction auditability (G3)<n>We validate with two crypto-agnostic instantiations -- basic (Ed25519, SHA-256; 97 us verify) and enhanced (BBS+ selective disclosure, Groth16 DV-SNARK; 13.8 ms)
  arXiv  Detail & Related papers  (2026-03-15T11:46:57Z)
• Internal Safety Collapse in Frontier Large Language Models [65.00730294617382]
  This work identifies a critical failure mode in frontier large language models (LLMs)<n>Under certain task conditions, models enter a state in which they continuously generate harmful content while executing otherwise benign tasks.<n>We introduce TVD, a framework that triggers ISC through domain tasks where generating harmful content is the only valid completion.
  arXiv  Detail & Related papers  (2026-03-04T12:55:34Z)
• Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents [31.789859492703016]
  The agent-tool communication loop is a critical attack surface in Large Language Model (LLM) agents.<n>Existing Denial-of-Service (DoS) attacks are ineffective for this new paradigm.<n>We introduce a stealthy, multi-turn economic DoS attack that operates at the tool layer under the guise of a correctly completed task.
  arXiv  Detail & Related papers  (2026-01-16T02:47:45Z)
• CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents [60.98294016925157]
  AI agents are vulnerable to prompt injection attacks, where malicious content hijacks agent behavior to steal credentials or cause financial loss.<n>We introduce Single-Shot Planning for CUAs, where a trusted planner generates a complete execution graph with conditional branches before any observation of potentially malicious content.<n>Although this architectural isolation successfully prevents instruction injections, we show that additional measures are needed to prevent Branch Steering attacks.
  arXiv  Detail & Related papers  (2026-01-14T23:06:35Z)
• BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents [58.83028403414688]
  Large language model (LLM) agents execute tasks through multi-step workflow that combine planning, memory, and tool use.<n>Backdoor triggers injected into specific stages of an agent workflow can persist through multiple intermediate states and adversely influence downstream outputs.<n>We propose textbfBackdoorAgent, a modular and stage-aware framework that provides a unified agent-centric view of backdoor threats in LLM agents.
  arXiv  Detail & Related papers  (2026-01-08T03:49:39Z)
• Trace: Securing Smart Contract Repository Against Access Control Vulnerability [58.02691083789239]
  GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files.<n>Third-party developers often reference, reuse, or fork code from these repositories during custom development.<n>Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories.
  arXiv  Detail & Related papers  (2025-10-22T05:18:28Z)
• STAC: When Innocent Tools Form Dangerous Chains to Jailbreak LLM Agents [38.755035623707656]
  This paper introduces Sequential Tool Attack Chaining (STAC), a novel multi-turn attack framework that exploits agent tool use.<n>We apply our framework to automatically generate and evaluate 483 STAC cases, featuring 1,352 sets of user-agent-environment interactions.<n>Our evaluations show that state-of-the-art LLM agents, including GPT-4.1, are highly vulnerable to STAC, with attack success rates (ASR) exceeding 90% in most cases.
  arXiv  Detail & Related papers  (2025-09-30T00:31:44Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.