This paper proposes Caper, which runs each shell command from a coding agent in a sandbox first, then decides whether to allow it.
How it works: Each command is pre-executed in a snapshotted sandbox under system-call tracing. An independent approver reviews a bounded report of the observed effects. Allowed commands are committed, and blocked ones are rolled back with a reason the agent can act on.
Results: Against six existing systems, Caper has the lowest harmful-outcome rate: 6.7% on SABER (vs. at least 14.8%) and 7.8% on YoloFS-Ext (vs. at least 35.3%). YoloFS-Ext is a benchmark the authors built, where harm is hidden inside the tools agents run.
Trade-off: It blocks 1.0% of the safe twins of the dangerous tasks in YoloFS-Ext.
Sign in to comment.
TL;DR of the paper, generated automatically.
This paper proposes Caper, which runs each shell command from a coding agent in a sandbox first, then decides whether to allow it.