Caper consequence-aware approval reduces harmful outcomes in coding agents
Original title: "Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents
Caper pre-executes commands in snapshotted sandbox and achieves lowest harmful-outcome rates of 6.7% on SABER and 7.8% on YoloFS-Ext versus at least 14.8% and 35.3% for existing systems.
Coding agents use automated approvers based only on command text. Caper pre-executes each command in a snapshotted sandbox to provide independent approver with bounded report of observed effects. Allowed commands are committed and blocked ones rolled back with reason. Compared to six existing systems Caper achieves lowest harmful-outcome rate on SABER (6.7% versus at least 14.8%) and custom YoloFS-Ext benchmark (7.8% versus at least 35.3%) while blocking 1.0% of safe twins. It blocks harmful behavior hidden inside invoked tools.
- Caper blocks 1.0% of safe twins in YoloFS-Ext
- Harmful behavior hidden inside invoked tools
- Pre-execution in snapshotted sandbox
- Independent approver receives bounded report
- Roll back blocked commands with agent-actionable reason
From the original article
1 min read at huggingface.co
Coding agents increasingly rely on automated approvers to decide whether a proposed shell command may run. Existing approvers, from rule-based checkers to guardrail models and deployed permission classifiers, base their decisions on the text of the request and command.
By Weiheng Wu, Junkai Chen, Zhensu Sun · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.