ActiveSecHarness proposes capability tokens for coding agents
Original title: From Attack Surface to Defense Architecture: Compositional Security for Agentic Coding Harnesses
On 252 fixtures, the authors report Ring 0 blocked every attack fixture with zero false positives in 12.7 microseconds.
A paper argues that agentic coding harnesses become living-off-the-land platforms once injected instructions reach shells, files, and network sockets, with binaries such as bash, curl, and find used as the payload. It presents ActiveSecHarness, a neurosymbolic reference monitor that separates intelligence from authority using HMAC capability tokens, a two-dimensional taint lattice, a workspace provenance ledger, and deterministic Ring-0 guards. Across 252 fixtures (120 attack, 120 benign, 12 kill chains), the authors report that a local qwen3:4b judge refused 98.3% of benign work at 142.3 ms, while Ring 0 scored ABR 1.000 and FPR 0.000 in 12.7 microseconds. In a trajectory ablation, a stateless oracle policy missed 4 of 12 kill chains.
Unconfirmed: Block rates, latency, and false-positive figures are the authors' measurements on their 252 fixtures.
- Static regex blacklists miss structural evasions, the authors argue.
- The lattice is trust crossed with sensitivity, plus a provenance ledger against secret laundering.
- Coarse Boolean taint blocked 83.3% of benign workflows in their ablation.
- Their 2D lattice reported ABR 1.000 and FPR 0.000 at about 20 microseconds per step.
Impact: Injected instructions can drive agent shells and network tools
- ATT&CK
- T1059.004 Unix Shell
- Products
- ActiveSecHarness
- AI models
- qwen3:4b
From the original article
1 min read at arxiv.orgAI coding harnesses couple language models to shells, filesystems, and network sockets, turning the harness into an automated Living-off-the-Land (LotL) platform: once an adversary injects instructions into retrieved content, dual-use binaries such as bash, curl, and find become the payload.
By Simon Hegelich · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.