From Attack Surface to Defense Architecture: Compositional Security of Agentic Coding Harnesses

Core problem: the coding agent's harness couples the language model to the shell, file system, and network; once the instruction stream is manipulated, the harness becomes an automated Living-off-the-Land (LotL) execution platform, and existing defenses cannot provide deterministic protection at the execution boundary.

• Problem scenario: coding agents such as SWE-agent and OpenHands directly reuse the host's dual-use binaries such as bash, curl, and find; the authors argue that high-severity failures such as symlink races, path traversal, SSRF, and credential leakage are classic OS problems accelerated by the agent toolchain, not new model behaviors.
• Shortcomings of existing methods: the authors state that static regex blacklists miss flag permutations and structured attacks; LLM-as-a-Judge has a second model guess physical invariants at a cost of tens to hundreds of milliseconds per call, and over-refuses benign work.
• Core claim: the authors argue that the security of agent systems is a structural property of the cognitive architecture and authority composition, not a behavioral property of a single language model; intelligence may propose actions, but must never define its own authority (Separation of Intelligence and Authority).
• The paper proposes: ActiveSecHarness — a neuro-symbolic reference monitor architecture organized around four Trust and Authority Rings, plus a six-domain LotL threat taxonomy (Domains A–F) and an N=252 evaluation suite.
• Threat model:
  • Attacker goal: by manipulating the agent's instruction stream, complete a kill chain of reconnaissance, weaponization, exploitation, privilege escalation, and persistence/exfiltration on the host.
  • Attacker knowledge and entry point: indirect prompt injection — embedding instructions in external content that will be retrieved (repository text, issues, MCP tool descriptions), without needing a direct interface.
  • Victim system: the coding harness and MCP servers running as the operator, inheriting the user's file, credential, and network permissions (ambient authority).
  • Defense assumption: no assumption of aligned model behavior; defense performs deterministic mediation at resource boundaries such as path resolution, process spawning, and socket connections.

Classic protection and capability mechanisms

• Saltzer and Schroeder (1975) — proposed protection principles such as complete mediation, least privilege, fail-safe defaults, and psychological acceptability; the paper uses these as criteria for judging harness defenses.
• Hardy (1988) — the confused deputy problem: a privileged component serves two masters but cannot distinguish the source of authority; the paper uses this to explain why ambient authority fails, and draws on the capability mechanism to unify naming and authorization.
• Birgisson et al. (2014)'s macaroons — authorization tokens with caveats can decay monotonically; the paper adapts them into agent capability tokens. Boucher and Anderson (2023)'s Trojan Source and Wheeler (2016)'s zxcvbn respectively support Unicode protection in Domain B and password checking in Domain D.

Coding and offense-defense agents

• SWE-agent (Yang et al., 2024), SWE-bench (Jimenez et al., 2024), OpenHands (Wang et al., 2025) — repository-level agents that directly operate the shell and browser.
• Fang et al. (2024) and Cybench (Zhang et al., 2025) — attack or evaluate agents' terminals and interpreters, demonstrating the same LotL attack surface. The paper states that its contribution is not yet another agent scaffold, but a reference monitor that can host these agents.

Prompt injection, tool risk, and MCP

• Greshake et al. (2023) — indirect prompt injection blurs the boundary between data and instructions; InjecAgent (Zhan et al., 2024) and AgentDojo (Debenedetti et al., 2024) quantify the harm after tool-calling agents are injected.
• ToolEmu (Ruan et al., 2024) — even the safest evaluated model still has 23.9% severe tool failures (according to its evaluator).
• Hou et al. (2025) — surveys MCP threats: lack of cryptographic verification in tool selection, rug pull after installation, and lack of runtime permission control; the paper treats these as sources of requirements for certificates, taint lattices, and Ring 0 mediation.

System-level agent defenses and neuro-symbolic AI

• IsolateGPT (Wu et al., 2025) — execution isolation for the LLM application ecosystem; AirGapAgent (Bagdasarian et al., 2024) — restricts accessible data per task.
• Conseca (Tsai & Bagdasarian, 2025) — uses an isolated model to generate just-in-time context security policies, executed deterministically per action; the paper points out that its policy "ignores prior actions," leaving the multi-step trace composition problem unsolved. CaMeL (Debenedetti et al., 2025) — extracts trusted control flow and labels capabilities, while also noting that heuristic detectors offer no security guarantees.
• The neuro-symbolic line of Cambria et al. (SenticNet 6/7/9, Seven Pillars) — the symbolic layer maintains interpretable explicit reasoning; Chen et al. (2026) — real-time control requires "scale-aware decoupling," and LLMs should not be placed in low-level execution loops.

Baselines and benchmarks: The experimental baselines are a static regex blacklist, a local LLM-judge (qwen3:4b), an Oracle Conseca-style stateless task policy, and a coarse-grained Boolean taint lock; evaluation uses the paper's self-built lotlimmune benchmark (N=252 fixtures).

Positioning: The authors state that ActiveSecHarness is complementary to Conseca-style policy generation — Conseca can propose an initial task-level permission scope, while Ring 0 pushes enforcement down to the LotL OS attack surface and closes its unsolved trace composition problem with a product lattice and WorkspaceProvenanceLedger.

Overall approach: treat the coding harness as a structural, compositional protection problem, and use ActiveSecHarness, a neuro-symbolic reference monitor architecture, to realize "intelligence may propose actions, but must never define its own authority." Neural models propose plans, code, and reviews in Rings 2–3, while Ring 0 enforces a formalized symbolic capability algebra, information-flow labels, and OS resource checks.

Authority: trust and authority rings and capability chains

• Four rings: Ring 0 is the immutable security kernel (an unbypassable reference monitor that mediates every tool call); Ring 1 is the human sovereignty layer (command de-obfuscation, explain-before-sudo, UserWikiManager lessons); Ring 2 is the privileged orchestrator and independent security review; Ring 3 is the unprivileged sandbox worker, offline by default.
• Capability tokens: HMAC-SHA256 chained CapabilityToken (modeled on macaroons), binding parent-child principal identities, a nonce per call, and remaining quota.
• Monotonic decay: a child token is valid if and only if Scope(τ_child) ⊆ Scope(τ_parent) — delegation can only add caveats, never expand scope.

Information flow: product lattice and compositional separation of duties

• Product taint lattice: L = L_trust × L_sens, where L_trust = {Trusted ⊑ Sanitized ⊑ Derived ⊑ Untrusted}, L_sens = {Public ⊑ Sensitive}; each session and workspace artifact carries a composite label (τ, σ).
• Action gating: when σ=Public, gating is by τ — Derived allows workspace read/write, archive unpacking, and isolated testing (SHELL TEST ISOLATED), and denies arbitrary shell and network egress; when σ=Sensitive, arbitrary shell and egress are blocked regardless of τ.
• Two kinds of downward operations: Sanitization (structural cleaning, such as stripping Trojan Source Bidi control characters) only lowers τ and does not touch σ; only deterministic credential redaction or an explicit Ring 1 operator exemption can lower σ to Public.
• WorkspaceProvenanceLedger: maps each canonical path to a composite label and a set of source side effects; when Agent A writes a file and Agent B reads it, the label propagates along join, and if the result would close a toxic combination (sensitive read + network egress/process execution), it is denied, preventing cross-agent money-laundering-style exfiltration via shared disk.

Enforcement: three mediation boundaries and deterministic interceptors

• Three layers of mediation: (1) agent/tool-call mediation (HMAC chain verification, certificate recomputation, lattice permission checks); (2) process and capability mediation (sanitized environment variables, per-binary forbidden flag tables, call-class binding); (3) OS/subprocess resource mediation (canonical path restrictions, RLIMIT quotas, O_NOFOLLOW staged unpacking, socket-level IP pinning, canary-triggered token revocation).
• Ring 0 interceptors (Section 4): ArchiveGuard streams decompression in 64 KiB chunks with byte/file-count/compression-ratio limits, ignoring sizes declared in ZIP headers; MalwareGuard checks ELF/PE/Mach-O/shebang magic numbers and strips Unicode Bidi control characters; CredentialGuard performs leetspeak de-obfuscated password checking (requiring Shannon entropy ≥ 4.0 bits/character) and bidirectional secret DLP; NetworkGuard resolves DNS once before connecting, rejects loopback/RFC1918/cloud metadata addresses, and pins the IP at the socket layer; SandboxGuard and CanaryGuard perform environment sanitization, resource quotas, and honeypot-file-triggered revocation.

Verification, self-healing, and human-factors defense

• Tool certificates: at registration, record the tool's Python bytecode SHA-256, AST digest, dependency digest, import path lock, and publisher HMAC signature; before each call, recompute the digest and abort on mismatch, making silent tampering of MCP tools detectable.
• Three-stage self-healing loop: the Ring 0 CodeVerifier checks generated code before execution at three scopes (TIER1 general AST invariants, TIER2 contextual data flow, TIER3 task-level probes); the Ring 2 DualModelReviewer uses an independent review model with clean context for Stage-B re-review and drives the Fix–Test–Verify repair loop; the SecurityTestSynthesizer only accepts probes satisfying the four Red–Green–Benign conditions.
• Audit log: HashChainedAuditLog splits each record into two cryptographic layers — a Tier-1 structural header (signing key, supporting real-time telemetry) and a Tier-2 forensic payload (encryption key, AEAD-sealed); an agent inside the workspace holds neither key and can only read ciphertext during reconnaissance.
• UserWikiManager: records each intercepted vulnerability or social-engineering trap as an immutable UserLearningCase, teaching progressively at three levels based on the operator's cumulative resolved cases (cases 1–2 everyday analogies, 3–4 security engineering patterns, 5+ adversarial and cryptographic details), with path restrictions, symlink rejection, Bidi stripping, and credential redaction before writing.

Formal guarantees

• Appendix A gives three propositions: delegation cannot expand scope (Proposition A.1); product lattice monotonicity and Sanitization does not accidentally downgrade sensitivity (A.2); non-exfiltration across agents via a shared workspace (A.3), plus proof sketches for greedy partitioning to avoid toxic sets (A.4), audit log resistance to reconnaissance (A.5), and zero-false-positive probe acceptance (A.6).

Experimental Setup

• Suite: lotlimmune benchmark, N=252 fixtures—120 single-step attacks, 120 benign software engineering cases, and 12 five-stage kill chains, covering Domains A–F, including held-out adversarial variants for each domain; benign cases are real issue reading → editing → isolated testing workflows.
• Five mediation modes: Unguarded (YOLO), static regex blacklist, local LLM-judge (Ollama qwen3:4b, zero-shot BLOCK/ALLOW prompt, 252 live calls with disk caching), ActiveSec Ring 0, and hybrid mode (LLM advisory only, Ring 0 authoritative, LLM cannot override Ring 0's allow).
• Metrics: ABR (proportion of attacks blocked, with kill chains counted as blocked end-to-end), FPR (proportion of benign cases denied), median and p95 wall-clock latency per call; interval estimates are Clopper–Pearson exact 95% confidence intervals.
• Ablation setup: 12 five-stage attack traces (KC-T01–KC-T12) + 12 five-stage benign SWE traces (BT-01–BT-12), comparing three purely deterministic policies; trace lengths k ∈ {1, 5, 10, 25, 50} to measure state-folding latency.
• Models tested: the only model run in the experiments is qwen3:4b (as LLM-judge and as the small coding model in Table 3); the paper reports no repetition counts.

Main Results

Per Table 4 (N=252, ABR denominator includes 12 kill chains for 132 attack rows in total; FPR based on 120 benign cases):

Swipe horizontally to read the table

Mode	ABR	FPR	Median (p95) latency
Unguarded	0.000 [0.00, 0.03]	0.000	0.1 µs (0.1 µs)
Regex	0.439 [0.35, 0.53]	0.000	6.6 µs (9.7 µs)
Live LLM-judge	1.000 [0.97, 1.00]	0.983	142.3 ms (512 ms)
ActiveSec Ring 0	1.000 [0.97, 1.00]	0.000	12.7 µs (0.56 ms)
Hybrid (Ring 0 authoritative)	1.000 [0.97, 1.00]	0.000	142.3 ms (512 ms)

• The authors say the local judge reaches ABR=1.000 only by rejecting 98.3% of benign SWE work (118/120), and explicitly note that qwen3:4b is the worst case for a 4B small model under zero-shot prompting.
• The authors say hybrid mode shows that a hard symbolic boundary can fully absorb the small neural judge's false positives (restoring FPR=0.000 without losing attack coverage), but synchronous per-call consultation still costs 142.3 ms of latency, showing that synchronously consulting a language model on every system call is the wrong architectural placement.
• Figure 2 shows Ring 0 median 12.7 µs, 11,200 times faster than the local judge, below the 1 ms interaction budget.

Single-Step Slice and Per-Domain Results (Experiment 1, N=240)

• Single-step slice: on 120 attacks + 120 benign, Unguarded ABR=0.000; Regex ABR=0.417 (50/120, [0.327, 0.510]), FPR=0.000; Ring 0 ABR=1.000 [0.970, 1.000], FPR=0.000.
• Per-domain ABR (Figure 3): Regex is 0.62 in Domain A and 0.77 in C, but only 0.18 in B (archive/Bidi), 0.24 in E (sandbox escape), 0.25 in D (credential DLP), and 0.52 in F (IPI/Trifecta); Ring 0 is 1.00 in all six domains.
• Authors' interpretation: regex blind spots are concentrated in structural, state-dependent checks (archive structure, magic numbers, deobfuscated passwords, compositional taint flows), which string patterns cannot encode.

Multi-Step Kill Chains and the Conseca Trace Problem (Experiment 3)

• Five-mode kill chain results: on 12 chains, Unguarded ABR=0.000 [0.000, 0.265]; Regex blocks 8/12 (0.667 [0.349, 0.901]); Ring 0, local judge, and hybrid each block 12/12 (1.000 [0.735, 1.000]).
• Oracle ablation (Table 5): to rule out model-capability confounding, the authors construct an Oracle Stateless Task Policy (Conseca-style, given the minimal tool set required by the task, zero policy-generation hallucination, step-by-step stateless decisions). Its FPR=0.000 (0/12), but ABR=0.667, missing 4/12 in-chain traces (KC-T03, 04, 05, 11)—each step is within authorization, and the harm comes from cross-step composition.
• Coarse-grained Boolean taint lock: ABR=1.000 (12/12) but FPR=0.833 (10/12 benign blocked), with only 2/12 purely offline local reconstructions surviving (BT-11, 12).
• Ring 0 product lattice + Ledger: ABR=1.000 and FPR=0.000; per-step state-folding latency is 19.6–22.0 µs for k=1…50 (at k=50, median 20.0 µs, p95 20.2 µs, 0.999 ms total for 50 steps), which the authors say confirms O(1) constant time per step with no need to enumerate the path tree.

Other Ablations and Analyses

• Regex miss patterns: Domain B structural members, Domain D deobfuscated passwords, and Domain F compositional taint flows bypass patterns that check only a single command string (Section 5.5).
• Ring 0 denial reason distribution: covers SandboxGuard workspace escape, ArchiveGuard path traversal, MalwareGuard magic numbers, lattice taint lock, forbidden flags, network pinning, and compositional Ledger checks (Section 5.4).
• Teaching cases: Table 3 shows two three-level lessons generated by UserWikiManager in a real workflow (Zip-Slip fix and obfuscated sudo trap), with no quantitative results.
• Negative results: the Oracle stateless policy misses 4/12 in-chain traces; the Boolean taint lock rejects 10/12 benign workflows; the local judge falsely rejects 118/120 benign cases—the authors' explanations are, respectively, that cross-step provenance composition exceeds per-action policies, that 1-bit taint cannot distinguish Derived from untrusted, and that the 4B model defaults to conservative rejection of dual-use development commands.

Limitations and Future Directions Noted by the Authors

• Small-model worst case (Section 7.1): the 0.983 FPR comes from a 4B local model with a zero-shot BLOCK/ALLOW prompt; the authors say frontier models (such as Gemini1.5 Pro used by Conseca) or multi-turn prompting would misjudge single actions far less often, but would still incur 10^3–10^4 times the latency and cannot check physical OS invariants.
• Scope of results (Section 7.1): Ring 0's ABR=1.000 and FPR=0.000 reflect deterministic enforcement of "well-typed mathematical and OS invariants" on structured tool-call fixtures; the authors explicitly do not claim that a small-model-driven harness can achieve 100% end-to-end task completion or zero semantic defects on arbitrary open-ended software engineering.
• Ring 2 capability dependence (Section 7.1): catching novel business-logic vulnerabilities in user code depends on the capabilities of DualModelReviewer and SecurityTestSynthesizer; task utility still declines when compact models do planning/coding (e.g., generating naive extractall drafts, multi-step fixes failing and requiring escalation to a larger model).
• Single-action accuracy does not equal a reliable executor (Section 7.1): the authors cite Mao et al. (2024) and Xu et al. (2025) to note uneven model capabilities and the difficulty of distinguishing benchmark scores from training-data exposure; "correctness is a gatekeeper for empirical averages, not a reference monitor."

Experimental Coverage

• The evaluated modes are five mediation modes plus three trace policies, all on the paper's self-built lotlimmune benchmark (N=252: 120 attacks, 120 benign, 12 kill chains); external benchmarks such as AgentDojo and InjecAgent were not used for evaluation.
• The only model run in the experiments is qwen3:4b (local Ollama, in judge and coding roles); the paper reports no measured data with any frontier model as judge or coder.
• Attack fixtures cover 21 sub-vectors across Domains A–F (appendix Table 6), including held-out adversarial variants for each domain; benign fixtures are issue-driven SWE workflows.
• The trace ablation includes 12 attack traces and 12 benign traces; the Oracle Conseca-style policy is an idealized upper bound constructed by the authors (zero policy-generation hallucination), not a measurement of the real Conseca system.
• The paper reports no repetition counts, no human evaluation, and no end-to-end quantitative results for the self-healing rings of CodeVerifier/DualModelReviewer/SecurityTestSynthesizer; components such as tool certificates and audit logs have no independent evaluation numbers.

A defense paper: addressing the problem of coding agents abusing host dual-use binaries (LotL) after indirect prompt injection, it proposes the ActiveSecHarness reference monitor architecture and provides a threat taxonomy and evaluation suite.

• Problem: the harness couples the language model to the shell, file system, and network; the authors argue that most high-severity failures are classic OS attack primitives accelerated by the toolchain, and that neither static blacklists nor LLM-as-a-Judge can provide deterministic protection at the execution boundary.
• Method: based on the principle of Separation of Intelligence and Authority—four trust and privilege rings, monotonic decay of HMAC capability tokens, a product taint lattice L_trust × L_sens plus WorkspaceProvenanceLedger for compositional separation of duties, with Ring 0 performing deterministic mediation at three boundaries: tool calls, processes, and OS resources; accompanied by tool certificates, dual-key audit logs, a self-healing code verification ring, and progressive user teaching.
• Main results: on the N=252 suite, Ring 0 and hybrid mode with Ring 0 authoritative achieve ABR=1.000 and FPR=0.000 with a median latency of 12.7 µs; the local LLM-judge (qwen3:4b) reaches the same ABR only via FPR=0.983, with 142.3 ms latency; regex ABR=0.439 (Table 4).
• Trace ablations: the idealized Oracle Conseca-style stateless policy misses 4/12 in-chain traces (ABR=0.667), the coarse-grained Boolean taint lock falsely rejects 10/12 benign workflows (FPR=0.833), and the product lattice approach scores full marks on both with about 20 µs per step (Table 5).
• Authors' conclusion: physical invariants and permission composition were never the language model's job; tuning model weights for refusal is a category error, and defenders need to use undiminished high-capability models within a secure harness.