Aletheia tests coding agent rules for minimal permissions to spot risks
Aletheia: Permission-Minimality Testing for Coding-Agent Rules
Cryptography and SecuritySoftware Engineering
Summary
Coding agents follow instructions to fix or create code, but these instructions might secretly ask for risky access like passwords. The authors created Aletheia, a way to test whether each permission an instruction asks for is really needed. By trying the task while removing one permission at a time, Aletheia can find which permissions are unnecessary and flag potentially dangerous requests. This helps keep coding agents secure by spotting hidden threats without blocking safe instructions.
What this means in practice
- •For software development teams: Detect and diagnose unnecessary permission requests in automated coding tools to improve security and prevent credential leaks.
- •For information security teams: Integrate permission-minimality checks into security audits of code generation agents to catch hidden malicious behavior in rule files.
Authors
Jieke Shi, Yuchen Chen, Junda He, Yue Liu, David Lo
Abstract
Repository instruction files guide coding agents, but also expose them to prompt injection. Malicious rules can request credential access or data transfer while the agent produces a correct patch. We present Aletheia, a framework for permission-minimality testing. Aletheia translates requested authority into a typed language and synthesizes executable sandbox configurations. It runs the unchanged rule and task under full permissions and independent restrictions that remove one permission at a time. Passing independent functional tests under strictly reduced authority provides a dispensability witness, which Aletheia interprets against task context to diagnose suspicious requests. We formalize synthesis and the conditions connecting witnesses to enforced restrictions. On a shared refactoring task, Aletheia executes and detects all 314 AIShellJack attack inputs, with no alarms on five benign templates. Among 80 manually verified benign GHAgentFiles rules, it raises three false positives (3.75%).