'Authority Is Not a String' derives task-level permission ceilings from trusted input and stores typed per-agent capabilities outside the model's context; every tool call is checked against the capabilities of the agent that issued it, so injected instructions can only execute what that agent was already allowed to do. On the Pi coding agent (300 runs; 5 tasks x 5 injection surfaces x 4 conditions): injected effects executed in 33-47 of 75 baseline runs versus 3/75 with CapScope, while repair completion stayed at 68/75 versus a baseline of 68-72/75.
CapScope: capability-scoped harnesses cut prompt-injection success to near zero
2026-09-10Frontier watchTRIAL
'Authority Is Not a String' derives task-level permission ceilings from trusted input and stores typed per-agent capabilities outside the model's context; every tool call is checked against the capabilities of the agent that issued it, so injected instructions can only execute what that agent was already allowed to do. On the Pi coding agent (300 runs; 5 tasks x 5 injection surfaces x 4 conditions): injected effects executed in 33-47 of 75 baseline runs versus 3/75 with CapScope, while repair completion stayed at 68/75 versus a baseline of 68-72/75.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
Injection defense without asking the model to recognize malicious text: authority becomes typed, external and enforced at the harness layer. This is a directly implementable pattern for any team running tool-using agents against untrusted content — and a measured result showing security without capability loss.
FRONTIER WATCH
Public artifacts and validated results are different.
The recorded fact is the public work and its artifacts. Author-reported outcomes do not establish independent reproduction. Next checks include usable code, task conditions and third-party validation.
Evidence & related material
Technical details & scores
| Arxiv | 2609.08371 (Wed 9 Sep digest, announced 2026-09-10T00:00Z) |
|---|---|
| Mechanism | task-level permission ceilings from trusted input; typed per-agent capabilities stored outside model context; per-issuer tool-call checks |
| Results | Pi coding agent, 300 runs (5 tasks x 5 injection surfaces x 4 conditions): injected effects executed 33-47/75 baseline vs 3/75 CapScope; repair completion 68/75 vs baseline 68-72/75 |
| Code | implemented on the open-source Pi coding agent; repo not stated |
Technical impact 4
Engineering value 5
Adoption signal 2
Maturity 2
Verification cost 3
Risk 2