Coding agents get safer tool controls to block sneaky commands
Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents
Software Engineering
Summary
Coding agents use tools that can read and change files, but this power can be misused by hidden instructions placed by attackers. The authors propose CapScope, a system that carefully limits what each part of an agent is allowed to do, so harmful commands inside files or outputs can’t cause unexpected actions. CapScope works by assigning specific permissions outside the agent’s main brain and checking every tool use against these permissions. Tests show CapScope blocks most injected bad actions while still letting the agent fix code effectively.
coding agentsprompt injectionsandboxingcapability-based securityauthorizationtool permissionssub-agentrepository filescode repairsoftware security
Authors
Dimitrios Stamatios Bouras, Yihan Dai, Sergey Mechtaev
Abstract
Coding agents use system-level tools to read files, execute commands, and modify source code. Within the agent's sandbox, these tools often carry ambient authority: naming a resource is sufficient to act on it. Indirect prompt injection exploits this authority by placing instructions in repository files or tool output that cause the agent to perform actions the user did not request. We propose CapScope, a harness-level authorization mechanism that restricts tool use without requiring the model to identify malicious text. Before repository contents or tool output are read, CapScope derives a task-wide authority ceiling from trusted input. It then assigns each agent a separate set of typed capabilities, stored outside the model's context. Every tool call is checked against the capabilities of the agent that issued it. Permissions assigned to one sub-agent are therefore not automatically available to another. An injection may cause an agent to request an action, but the request is blocked unless that agent already has the required capability. We implement CapScope on the Pi coding agent and evaluate it in a repair workflow where an orchestrator delegates subtasks to separate sub-agents. The evaluation covers five Python tasks, five injection surfaces, four authorization conditions, and three trials per cell (300 runs). The injected effect executes in 33-47/75 runs under the ambient-authority and global-policy baselines, compared with 3/75 under CapScope. CapScope completes 68/75 repairs, while the baselines complete 68-72/75.