research (arXiv:2611.13960 preprint, Nov 10, 2026; not peer reviewed; benchmark built and scored by the authors)
Paper: treat a coding agent's harness as a Living-off-the-Land platform, and enforce permissions outside the model with capability tokens and taint tracking
Useful takeaway (opinion): regex blocklists and LLM-as-judge guards both fail in predictable ways; track which data came from untrusted sources and gate what tool calls it can influence.
Caveats: self-built benchmark, single small judge model, no third-party red team.