🤖 AI Summary
This work addresses the "privilege laundering" problem in tool-augmented agents, where individually benign tool permissions can combine to enable unsafe behaviors. The authors propose a transparent runtime defense mechanism that requires no modifications to either the agent or tool servers. Built upon an MCP proxy, the approach introduces receiver-oriented capability budgets and enforces monotonic capability decay through intersection-based propagation, ensuring that combined permissions can only weaken—not strengthen—during composition. By integrating explicit information flow control with a trusted allowlist, the method reduces attack success rates from 25–68% to 0–4.8% across 82 tasks while maintaining normal task completion rates of 96–100%, substantially outperforming existing baselines.
📝 Abstract
Tool-using agents increasingly operate in open-ended deployment environments, where they compose file systems, web APIs, code interpreters, and enterprise services at runtime. This creates a safety gap in tool composition: an agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect, such as reading a confidential document, summarizing it, and sending the summary to an external endpoint. We call this failure mode permission laundering. ChainCaps addresses it with a runtime rule: every value carries a sink-specific capability budget, and tool composition propagates budgets by intersection. A value can preserve or lose authority as it moves through a tool chain, but it cannot gain new authority through composition. We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers. On 82 tasks across five frontier models from three providers, ChainCaps reduces attack success rate from 25-68% to 0-4.8% while preserving 96-100% benign completion. In replay experiments, it also outperforms scalar-IFC and per-function-isolation baselines. Manifest quality is the dominant deployment bottleneck: expert manifests reach 100% attack blocking, while naive manifests fall to 27.3%. Our claims are limited to explicit-flow composition safety under trusted manifests and proxy-visible data movement, a practical gap in deployed tool-using agents today.