Capabilities limit coding agents to prevent unauthorized actions
Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents
Software Engineering
Summary
Coding agents often have broad access to files and commands, which can let hidden instructions trick them into doing unintended things. The authors created CapScope, a system that tightly controls what these agents can do by giving each specific permissions that can't be misused by others. Their tests show this method drastically reduces harmful actions from hidden instructions while still allowing agents to complete their main tasks effectively.
What this means in practice
- •For software development teams: Prevent coding assistants from executing unauthorized changes by assigning fine-grained permissions to their tasks.
- •For devops engineers: Improve safety of automated code repair pipelines by isolating permissions among sub-agents handling different steps.
Authors
Dimitrios Stamatios Bouras, Yihan Dai, Sergey Mechtaev
Abstract
Coding agents use system-level tools to read files, execute commands, and modify source code. Within the agent's sandbox, these tools often carry ambient authority: naming a resource is sufficient to act on it. Indirect prompt injection exploits this authority by placing instructions in repository files or tool output that cause the agent to perform actions the user did not request. We propose CapScope, a harness-level authorization mechanism that restricts tool use without requiring the model to identify malicious text. Before repository contents or tool output are read, CapScope derives a task-wide authority ceiling from trusted input. It then assigns each agent a separate set of typed capabilities, stored outside the model's context. Every tool call is checked against the capabilities of the agent that issued it. Permissions assigned to one sub-agent are therefore not automatically available to another. An injection may cause an agent to request an action, but the request is blocked unless that agent already has the required capability. We implement CapScope on the Pi coding agent and evaluate it in a repair workflow where an orchestrator delegates subtasks to separate sub-agents. The evaluation covers five Python tasks, five injection surfaces, four authorization conditions, and three trials per cell (300 runs). The injected effect executes in 33-47/75 runs under the ambient-authority and global-policy baselines, compared with 3/75 under CapScope. CapScope completes 68/75 repairs, while the baselines complete 68-72/75.