Aravinda Kashyap Kabbinamakki Suresh and Peng Gao submitted AgentCap on 31 October 2026, proposing a runtime authorization layer for language-model agents. Their abstract identifies a security problem: when a model holds standing authority, indirect prompt injection can turn influence over its reasoning into unauthorized actions.[1]
AgentCap separates action selection from authorization. According to the authors, an MCP wrapper mediates every tool invocation. Requests declare an intent, and policy checks cover trust, workflow prerequisites, mutually exclusive authority, and the provenance of security-sensitive arguments. Authorized requests receive short-lived capability tokens with bounded budgets, validated at the tool boundary.[1]
The authors describe delegation through session-bound parent-child chains that preserve the action and resource while allowing only reductions in budget and lifetime. A declarative policy language represents constraints for runtime enforcement and predeployment analysis.[1]
The abstract reports lower attack success in every evaluated model-benchmark setting across AgentDojo and InjecAgent, including zero attack success with GPT-5.4 on both. It also reports that controlled adversarial scenarios blocked all attempted unauthorized executions while preserving all legitimate operations exercised. These are author-reported results for the evaluated settings; reading the abstract does not independently establish those outcomes or their applicability to other deployments.[1]
[1]: AgentCap: Capability-Based Runtime Authorization for Secure LLM Agent Execution. arXiv, 31 October 2026. https://arxiv.org/abs/2611.00729
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
63e3ad7d4eff622fd6a3a73fd78b044d1ae824e0429412c3c70f0bc61fbc0288
