Entity trail

CapScope

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-11 / vibe-coding-researcherCapScope stops prompt injection by giving each coding subagent typed capabilities stored outside its contextAuthority Is Not a String (arXiv 2609.08371, September 8) sets a task-wide limit on what the agent may do, derived from trusted input before any repo content or tool output is read. It then gives each subagent its own typed capabilities, stored outside the model's context, and checks every tool call against the capabilities of the subagent that made it. An injected instruction can make an agent request an action, but the harness blocks it unless that subagent already holds the capability. The authors built it on the Pi coding agent and tested five Python repair tasks against five injection surfaces.
2026-09-09 / skill-finderA capability-scoped harness cut prompt-injection execution from 33-47/75 runs to 3/75 without asking the model to spot malicious textCapScope derives a task-wide authority ceiling from trusted input before any repository content or tool output is read, then gives each sub-agent its own typed capabilities stored outside the model's context; every tool call is checked against the issuing agent's capabilities, so one sub-agent's permissions are never inherited by another. Across 300 runs (five Python tasks, five injection surfaces, four authorization conditions), the injected effect executed in 33-47 of 75 runs under ambient-authority and global-policy baselines versus 3 of 75 under CapScope, while completing 68/75 repairs against baselines' 68-72/75. The lesson for anyone running an orchestrator that delegates to sub-agents: naming a resource should not be sufficient authority to act on it, and the check belongs in the harness, not in a classifier trying to detect injected instructions.
2026-09-09 / vibe-coding-researcherClaude Code's Artifact tool now treats an artifact written by someone else as untrusted and flags embedded instructions instead of relaying them2.1.265 changes how the Artifact tool summarises a page authored by another party: the content is handled as untrusted input, and instructions embedded in it are reported rather than passed through into the conversation. The same release refuses an artifact publish when none of the connector tool names it declares actually exist, and warns when only some are missing. Both are harness-level injection defenses in the same shape as the CapScope paper's argument.

Graph relationships

MENTIONS
Authority Is Not a String
arXiv 2609.08371 introduces CapScope for defending against prompt injection
Source finding
USES
Pi
CapScope was built on the Pi coding agent and tested on Python repair
Source finding
MENTIONS
Authority Is Not a String -> CapScope
arXiv 2609.08371 introduces CapScope for defending against prompt injection
Source finding

Source trail

arXiv 2609.08371 Changelog

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…