Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents

• URL: http://arxiv.org/abs/2609.08371v1
• Date: Tue, 08 Sep 2026 07:37:00 GMT
• Title: Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents
• Abstract summary: Coding agents use system-level tools to read files, execute commands, and modify source code.<n>Indirect prompt injection exploits this authority by placing instructions in repository files or tool output that cause the agent to perform actions the user did not request.<n>We propose CapScope, a harness-level authorization mechanism that restricts tool use without requiring the model to identify malicious text.
• Score: 1.8587887164315786
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Coding agents use system-level tools to read files, execute commands, and modify source code. Within the agent's sandbox, these tools often carry ambient authority: naming a resource is sufficient to act on it. Indirect prompt injection exploits this authority by placing instructions in repository files or tool output that cause the agent to perform actions the user did not request. We propose CapScope, a harness-level authorization mechanism that restricts tool use without requiring the model to identify malicious text. Before repository contents or tool output are read, CapScope derives a task-wide authority ceiling from trusted input. It then assigns each agent a separate set of typed capabilities, stored outside the model's context. Every tool call is checked against the capabilities of the agent that issued it. Permissions assigned to one sub-agent are therefore not automatically available to another. An injection may cause an agent to request an action, but the request is blocked unless that agent already has the required capability. We implement CapScope on the Pi coding agent and evaluate it in a repair workflow where an orchestrator delegates subtasks to separate sub-agents. The evaluation covers five Python tasks, five injection surfaces, four authorization conditions, and three trials per cell (300 runs). The injected effect executes in 33-47/75 runs under the ambient-authority and global-policy baselines, compared with 3/75 under CapScope. CapScope completes 68/75 repairs, while the baselines complete 68-72/75.

Related papers

• LLM Agent Capabilities Should Follow Task Intent and Context Source [3.0990248963651355]
  Unlike traditional systems, where capability is predefined, the least-privilege capability an agent needs is dynamic.<n>This creates a security and safety challenge: all inputs enter one shared planning channel with equal influence, yet a user's explicit request and a document's extracted text carry different trust and should not share authority to choose a destination or widen access.<n>IntentCap composes capabilities from four such sources: user intent, workflow instructions, tool schemas, and runtime environment, with field-level ownership and monotonic narrowing.
  arXiv  Detail & Related papers  (2026-09-13T16:04:31Z)
• Five Primitives for Governing Autonomous AI Agents at Runtime [0.0]
  We argue that governing autonomous AI agents is a problem, not a model-alignment problem.<n>We derive five primitives from the questions that must be answered before an action takes effect.<n>We describe an implementation in which an agent's action is mediated against policy before it takes effect.
  arXiv  Detail & Related papers  (2026-08-27T06:53:11Z)
• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• Agent Security Needs Redefinition through a Holistic Framework [46.88917910966891]
  Defenses ask whether an instruction looks malicious. Benchmarks ask whether an agent performs a harmful sounding action.<n>We operationalize contextual security through four properties that must hold jointly and be evaluated continuously across the agent's trajectory.
  arXiv  Detail & Related papers  (2026-07-24T06:43:09Z)
• Coding Agents Are Guessing: Measuring Action-Boundary Violations in Underspecified DevOps Instructions [16.871217408296932]
  We present UnderSpecBench, a benchmark for measuring action-boundary violations in coding agents.<n>UnderSpecBench includes 69 task families grounded in documented incidents, CVEs, or tool behavior.<n>To isolate underspecification from task difficulty, each task keeps the same environment and ground-truth safe action.
  arXiv  Detail & Related papers  (2026-07-02T15:11:39Z)
• Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? [54.701199583505144]
  Cross-application access creates a privacy risk that has been largely overlooked.<n>We introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios.<n>We evaluate 15 frontier agents and find a surprisingly high failure rate.
  arXiv  Detail & Related papers  (2026-06-22T11:36:58Z)
• ClayBuddy: A Framework, Evaluation, & Mitigation of Coding Agent Failures [1.0742675209112622]
  We study failure modes as stemming from three mechanisms: underspecification, capability errors, and agent harness errors.<n>We propose ClayBuddy, a harness that molds to user preferences and can be modified by the model in-session to mitigate these errors.
  arXiv  Detail & Related papers  (2026-06-13T18:29:53Z)
• ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation [11.138472843474505]
  We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers.<n>On 82 tasks across five frontier models from three providers, ChainCaps reduces attack success rate from 25-68% to 0-4.8%.<n>Our claims are limited to explicit-flow composition safety under trusted manifests and proxy-visible data movement.
  arXiv  Detail & Related papers  (2026-05-26T04:44:59Z)
• SkillJect: Automating Stealthy Skill-Based Prompt Injection for Coding Agents with Trace-Driven Closed-Loop Refinement [120.52289344734415]
  We propose an automated framework for stealthy prompt injection tailored to agent skills.<n>The framework forms a closed loop with three agents: an Attack Agent that synthesizes injection skills under explicit stealth constraints, a Code Agent that executes tasks using the injected skills and an Evaluate Agent that logs action traces.<n>Our method consistently achieves high attack success rates under realistic settings.
  arXiv  Detail & Related papers  (2026-02-15T16:09:48Z)
• Who Grants the Agent Power? Defending Against Instruction Injection via Task-Centric Access Control [25.109590157742712]
  We present AgentSentry, a lightweight runtime access control framework that enforces dynamic, task-scoped permissions.<n>Instead of granting broad, persistent permissions, AgentSentry dynamically generates and enforces minimal, temporary policies.<n>We demonstrate that AgentSentry successfully prevents an instruction injection attack, where an agent is tricked into forwarding private emails.
  arXiv  Detail & Related papers  (2025-10-30T07:36:59Z)
• DeepAgent: A General Reasoning Agent with Scalable Toolsets [111.6384541877723]
  DeepAgent is an end-to-end deep reasoning agent that performs autonomous thinking, tool discovery, and action execution.<n>To address the challenges of long-horizon interactions, we introduce an autonomous memory folding mechanism that compresses past interactions into structured episodic, working, and tool memories.<n>We develop an end-to-end reinforcement learning strategy, namely ToolPO, that leverages LLM-simulated APIs and applies tool-call advantage attribution to assign fine-grained credit to the tool invocation tokens.
  arXiv  Detail & Related papers  (2025-10-24T16:24:01Z)
• SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints [59.645885492637845]
  SOPBench is an evaluation pipeline that transforms each service-specific SOP code program into a directed graph of executable functions.<n>Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions.<n>We evaluate 18 leading models, and results show the task is challenging even for top-tier models.
  arXiv  Detail & Related papers  (2025-03-11T17:53:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.