---
title: Paper: treat a coding agent's harness as a Living-off-the-Land platform, and enforce permissions outside the model with capability tokens and taint tracking | ctxsec
url: https://ctxsec.com/items/arxiv-activesecharness-coding-agent-harness-reference-monitor-capability-tokens-taint-lattice
description: "The authors argue that once prompt injection lands in retrieved content, an AI coding harness's bash, curl and find become the payload, so security has to come from how permissions are composed, not from the model. Their ActiveSecHarness design separates 'intelligence' from 'authority' with HMAC capability tokens across four trust rings, a trust-by-sensitivity taint lattice with a workspace provenance ledger to stop secrets being laundered through files, and deterministic OS/tool guards. On their 252-fixture suite they report the deterministic layer blocked all attacks with no false positives in microseconds, while a small local LLM judge (qwen3:4b) refused 98.3% of benign work."
status: "research (arXiv:2611.13960 preprint, Nov 10, 2026; not peer reviewed; benchmark built and scored by the authors)"
published: 2026-11-12
---

> The authors argue that once prompt injection lands in retrieved content, an AI coding harness's bash, curl and find become the payload, so security has to come from how permissions are composed, not from the model. Their ActiveSecHarness design separates 'intelligence' from 'authority' with HMAC capability tokens across four trust rings, a trust-by-sensitivity taint lattice with a workspace provenance ledger to stop secrets being laundered through files, and deterministic OS/tool guards. On their 252-fixture suite they report the deterministic layer blocked all attacks with no false positives in microseconds, while a small local LLM judge (qwen3:4b) refused 98.3% of benign work.

[← Context & Harness Attacks](/context) · [markdown](/items/arxiv-activesecharness-coding-agent-harness-reference-monitor-capability-tokens-taint-lattice.md)

research (arXiv:2611.13960 preprint, Nov 10, 2026; not peer reviewed; benchmark built and scored by the authors)

2026-11-12 7:40 AM ET

### Paper: treat a coding agent's harness as a Living-off-the-Land platform, and enforce permissions outside the model with capability tokens and taint tracking

- **Useful takeaway (opinion):** regex blocklists and LLM-as-judge guards both fail in predictable ways; track which data came from untrusted sources and gate what tool calls it can influence.
- **Caveats:** self-built benchmark, single small judge model, no third-party red team.

Sources: [arXiv:2611.13960, From Attack Surface to Defense Architecture: Compositional Security for Agentic Coding Harnesses (Nov 10, 2026)](https://arxiv.org/abs/2611.13960)