Sandboxing Agent Tool Calls with Capability Tokens

Abstract

Tool-using agents are typically granted broad credentials, so a single injected instruction can cause large harm. We describe a capability-token scheme in which every tool call carries a narrowly scoped, short-lived token issued by a policy layer outside the model. A prototype blocks all 41 attack scripts in our test suite with under 4 ms of added latency.

Keywords sandboxing · capabilities · prompt injection · security