Capability-Based Security

Follow this topic Ask about this topic

Capability-based security gives users and programs explicit authority to perform specific actions, rather than relying only on identity or broad roles. For AI agents, common approaches include attenuating delegation tokens, runtime brokers and sandboxes, and type or effect systems that mediate tool use, secrets, and other side effects. Work evaluates these designs with formal models and adversarial tests of tool workflows, delegation, prompt injection, and stale permissions. A central challenge is ensuring that authority stays bounded when agents and tools compose, while reliably checking that policies, provenance, and revocation apply to the exact action being executed.

Latest papers

27 papers2 papers in the last four weeks, down 33% on the four weeks before. 0.0% of all new papers.

Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills
Oct 13, 2026Ratnesh Pandey, Japneet Singh, Harsh Akshit +2AI Agent Security Agent Skill Security Auditing
Metano Labs · Purdue University · VulNow
Approval Laundering: Systematizing Approval--Execution Binding Failures in AI Coding-Agent Harnesses
Sep 30, 2026Yang WangAI Agent Security Capability-Based Security
Fudan University
NostrAgent: A Decentralized Identity and Delegation Architecture for Sovereign Agentic Systems
Sep 19, 2026Oliver Aleksander Larsen, Mahyar Tourchi MoghaddamAI Agent Security AI Agent Governance
University of Southern Denmark, Odense, Denmark
Runtime Authorization for Resources Acquired by AI Agents
Sep 13, 2026Genliang Zhu, Chu WangAI Agent Security Runtime Enforcement for AI Agents
Accentrust · Georgia Institute of Technology · Accentrust, Vancouver, Canada +3
CAPMAS: Capability-Based Delegation of Privileges in Multi-Agent Systems
Sep 6, 2026Rasmus Moorits Veski, Rachid Guerraoui, David FroelicherTool Access Control for LLM Agents Multi-Agent System Security
EPFL / Swisscom · EPFL · Swisscom
WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents
Aug 25, 2026Lin-Fa Lee, YI-YU Chang, Kuo-Hui YehLLM Agent Security Tool Access Control for LLM Agents
Department of Institute of Artificial Intelligence Innovation National Yang Ming Chiao Tung University Hsinchu, Taiwan
InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents
Aug 13, 2026Zhenhua Zou, Sheng Guo, Qiuyang Zhan +3AI Accountability AI Agent Security
A Paper from the DeepKernel Lab
Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs
Jul 30, 2026Pingyu Wu, Lingyao Zhu, Weiming Zhang +1Adversarial Attacks on LLMs Safety Filtering
University of Science and Technology of China · Hefei AiDA Lab · Zhejiang Wanli University
Governed Individuation: Cryptographically Decoupling an Agent's Learning from Its Authority
Jul 6, 2026Xue Qin, Simin Luan, Cong Yang +1AI Agent Security AI Agent Safety
School of Software, Harbin Institute of Technology, Harbin, China · School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China · School of Future Science and Engineering, Soochow University, Suzhou, China
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
Jun 27, 2026Ting LiuMCP Security LLM Agent Security
SymbolicLight Research Foshan, Guangdong, China
Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents
Jun 21, 2026Igor Santos-GrueiroCoding Agents AI Agent Security
International University of La Rioja
Sovereign Execution Broker: Enforcing Certificate-Bound Authority in Agentic Control Planes
Jun 18, 2026Jun He, Deying YuAI Agent Security Capability-Based Security
A Five-Plane Reference Architecture for Runtime Governance of Production AI Agents
Jun 10, 2026Krti TallamAI Agent Security Capability-Based Security
Kamiwaza
Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents
Jun 2, 2026Yingqi ZhangAI Agent Security LLM Agents
Department of Computer Science and Technology, Tsinghua University Beijing, China
ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation
May 26, 2026Xiaochong Jiang, Shiqi Yang, Ziwei Li +3LLM Agent Security Capability-Based Security
Independent Researcher, Seattle, WA, USA · Independent Researcher, New York City, NY, USA · King Abdullah University of Science and Technology, Saudi Arabia
Governed Metaprogramming for Intelligent Systems: Reclassifying Eval as a Governed Effect
May 5, 2026Alan L. McCannCapability-Based Security AI Agent Governance
Mashin, Inc.
Certified Purity for Cognitive Workflow Executors: From Static Analysis to Cryptographic Attestation
May 1, 2026Alan L. McCannRemote Attestation Formal Verification
Mashin, Inc.
Algebraic Semantics of Governed Execution: Monoidal Categories, Effect Algebras, and Coterminous Boundaries
May 1, 2026Alan L. McCannFormal Verification Capability-Based Security
Mashin, Inc.
Skills as Verifiable Artifacts: A Trust Schema and a Biconditional Correctness Criterion for Human-in-the-Loop Agent Runtimes
May 1, 2026Alfredo MetereAI Agent Security LLM Agent Verification
Enclawed, LLC, California, USA
The Two Boundaries: Why Behavioral AI Governance Fails Structurally
Apr 30, 2026Alan L. McCannCapability-Based Security AI Agent Governance
Mashin, Inc.
SUDP: Secret-Use Delegation Protocol for Agentic Systems
Apr 27, 2026Xiaohang Yu, Hejia Geng, Xinmeng Zeng +1Cybersecurity LLM Agent Security
Imperial College London · Science Intelligence · University of Oxford +1
CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution
Apr 18, 2026Shutong Jin, Ruiyi Guo, Ray C. C. CheungAI Agent Security LLM Agent Security
City University of Hong Kong, Hong Kong · Beijing Foreign Studies University
AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A
Mar 25, 2026Sunil PrakashAI Agent Security Tool Access Control for LLM Agents
Indian School of Business, India
Capability Safety as Datalog: A Foundational Equivalence
Mar 20, 2026Cosimo SperaCapability-Based Security
Minerva CQ, 114 Lester Ln, Los Gatos, CA 95032.
Safety is Non-Compositional: A Formal Framework for Capability-Based AI Systems
Mar 16, 2026Cosimo SperaAI Agent Safety Capability-Based Security
Minerva CQ, Los Gatos, CA 95032
The Bureaucracy of Speed: Structural Equivalence Between Memory Consistency Models and Multi-Agent Authorization Revocation
Mar 10, 2026Vladyslav ParakhinAccess Control Tool Access Control for LLM Agents
Senior Data Engineer, Okta
Tracking Capabilities for Safer Agents
Mar 1, 2026Martin Odersky, Yaoyu Zhao, Yichen Xu +2AI Agent Safety Tool Access Control for LLM Agents
EPFL Lausanne, Switzerland

Oct 13, 2026J/K move · Enter open · S save

Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills

Ratnesh Pandey, Japneet Singh, Harsh Akshit, Sonali Tyagi+1

Metano Labs · Purdue University · VulNow

AI Agent Security Agent Skill Security Auditing Tool Access Control for LLM Agents Capability-Based Security

Open paper AskPDF arXiv

Agent skills are Markdown documents that a tool-using agent reads as instructions and then acts on with the privileges of the session that loaded them. Installing one grants authority (the standing to direct the agent, not new privilege), and the size of that grant is what we measure. We present a two-phase attack-surface profiling methodology that combines whole-bundle static analysis and dependency provenance checking with instrumented sandbox execution and separate model-based assessment of the resulting traces. We apply the methodology to 6,309 listings from two marketplaces, selecting listings for execution without conditioning that decision on a prior threat or risk signal. Half the corpus carries evidence of shell-execution capability; the corresponding shares are 35% for filesystem read, 31% each for filesystem write and network egress, and 13% for credential access; seven listings in ten carry at least one elevated capability. That is the surface a user accepts at install time, and almost none of it is visible then. A permission model exists but is close to inert. Authors may list the tools a skill pre-approves in its own frontmatter, which removes confirmation prompts rather than restricting what the skill can reach; of the 6,061 listings whose frontmatter parses, 770 declare anything at all, the vocabulary cannot express credential or environment access, and nothing checks what it does express against the bundle. Declaring is also not declaring accurately: 59% of declaring listings understate what their bundle can do. ClawHub declares roughly twice as often as skillsmp, yet under-declares on 88% of its declarations against 31%. Triage at the marketplace boundary therefore cannot rest on what a listing declares. It must rest on what the bundle can do. These results position capability-oriented attack-surface profiling as a necessary complement to maliciousness detection.