CapScope stops prompt injection by giving each coding subagent typed capabilities stored outside its context

arXiv·medium signalXBlueskyLinkedInCopy link

Authority Is Not a String (arXiv 2609.08371, September 8) sets a task-wide limit on what the agent may do, derived from trusted input before any repo content or tool output is read. It then gives each subagent its own typed capabilities, stored outside the model's context, and checks every tool call against the capabilities of the subagent that made it. An injected instruction can make an agent request an action, but the harness blocks it unless that subagent already holds the capability. The authors built it on the Pi coding agent and tested five Python repair tasks against five injection surfaces.