Aletheia: Permission-Minimality Testing for Coding-Agent Rules
Aletheia tests coding-agent rules for excess permissions and catches all 314 AIShellJack attacks.
Aletheia tests whether coding-agent repository rules request more authority than a task needs, a path for prompt injection that still yields a correct patch. It translates requested permissions into a typed language, synthesizes sandbox configurations, and compares full access with restrictions that drop one permission at a time. On a shared refactoring task it detected all 314 AIShellJack attack inputs and raised no alarms on five benign templates. Among 80 manually verified benign GHAgentFiles rules, it produced three false positives (3.75%).
- Aletheia synthesizes sandboxes and removes one permission at a time.
- It detected all 314 AIShellJack inputs on a shared refactoring task.
- Five benign templates raised no alarms; 80 GHAgentFiles rules yielded three false positives.
- Unnecessary authority is diagnosed from a dispensability witness and task context.
- Products
- Aletheia
From the original article
1 min read at arxiv.orgRepository instruction files guide coding agents, but also expose them to prompt injection. Malicious rules can request credential access or data transfer while the agent produces a correct patch. We present Aletheia, a framework for permission-minimality testing.
By Jieke Shi · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.