ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation

2026-05-26 · Xiaochong Jiang, Shiqi Yang, Ziwei Li, Lifei Liu, Haoran Yu, Yichen Liu arxiv

Tool-using agents increasingly operate in open-ended deployment environments, where they compose file systems, web APIs, code interpreters, and enterprise services at runtime. This creates a safety gap in tool composition: an agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect, such as reading a confidential document, summarizing it, and sending the summary to an external endpoint. We call this failure mode permission laundering. ChainCaps addresses it with a runtime rule: every value carries a sink-specific capability budget, and tool composition propagates budgets by intersection. A value can preserve or lose authority as it moves through a tool chain, but it cannot gain new authority through composition. We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers. On 82 tasks across five frontier models from three providers, ChainCaps reduces attack success rate from 25-68% to 0-4.8% while preserving 96-100% benign completion. In replay experiments, it also outperforms scalar-IFC and per-function-isolation baselines. Manifest quality is the dominant deployment bottleneck: expert manifests reach 100% attack blocking, while naive manifests fall to 27.3%. Our claims are limited to explicit-flow composition safety under trusted manifests and proxy-visible data movement, a practical gap in deployed tool-using agents today.

📄 PDF Abstract BibTeX arXiv:2605.26542

Code (0)

등록된 구현이 없습니다.

Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies

2026-07-03 · Chris Schneider, Kriti Faujdar, Philipp Schoenegger, Ben Bariach arxiv

Modern AI agent implementations such as frontier coding agents chain multiple tools at runtime that create a security surface that per-tool guardrails are unable to address, as individually permitted tools can violate or…

Adaptive Value Decomposition with Greedy Marginal Contribution Computation for Cooperative Multi-Agent Reinforcement Learning

2023-02-14 · Shanqi Liu, Yujing Hu, Runze Wu, Dong Xing 외

Real-world cooperation often requires intensive coordination among agents simultaneously. This task has been extensively studied within the framework of cooperative multi-agent reinforcement learning (MARL), and value de…

Multi-agent Reinforcement Learning

SciTrace: Trajectory-Aware Safety Reasoning for Scientific Discovery Agents

2026-06-06 · Tanush Swaminathan, Runmin Jiang, Letian Zhang, Min Xu arxiv

LLM-based scientific agents have shown strong capacity for autonomous research, yet their safety layers remain structurally divorced from core reasoning: they inspect pipeline outputs rather than shaping the deliberation…

Adversarial Robustness

GuardianAgentBench: Where Agents Fail and How to Guard Them

2026-07-23 · Vishal Ishwar Naik, Chenyu Xu, Donna Dong, Hussein Hassan 외 arxiv

As large language model agents increasingly operate autonomously with access to tools and external environments, ensuring their safe and reliable behavior becomes critical. We present GuardianAgentBench (GABench), a benc…

Adversarial Attack

Hidden in Plain Sight: Benchmarking Agent Safety Against Decomposition Attacks with DECOMPBENCH

2026-06-12 · Vikhyath Kothamasu, Virginia Smith, Chhavi Yadav arxiv

LLM-based Agents are becoming increasingly capable and widely deployed, creating growing incentives for adversarial misuse in the real-world. A key emerging threat is Decomposition Attacks \cite{glukhov2024breach, jones2…