A capability-scoped harness cut prompt-injection execution from 33-47/75 runs to 3/75 without asking the model to spot malicious text
CapScope derives a task-wide authority ceiling from trusted input before any repository content or tool output is read, then gives each sub-agent its own typed capabilities stored outside the model's context; every tool call is checked against the issuing agent's capabilities, so one sub-agent's permissions are never inherited by another. Across 300 runs (five Python tasks, five injection surfaces, four authorization conditions), the injected effect executed in 33-47 of 75 runs under ambient-authority and global-policy baselines versus 3 of 75 under CapScope, while completing 68/75 repairs against baselines' 68-72/75. The lesson for anyone running an orchestrator that delegates to sub-agents: naming a resource should not be sufficient authority to act on it, and the check belongs in the harness, not in a classifier trying to detect injected instructions.
↳ Follow the thread