Tracking Capabilities for Safer Agents

A March 1, 2026 arXiv paper by Yichen Xu proposes placing AI agents in a programming-language-based "safety harness" that uses Scala 3 with capture checking, so agents express tool-call intentions as code in a capability-safe language rather than calling tools directly. The paper reports that agents can generate capability-safe code with no significant loss in task performance while the type system reliably prevents unsafe behaviors such as information leakage and malicious side effects, including prompt injection. The work was revised as v2 on May 7, 2026.

Computer Science Artificial Intelligence Submitted on 1 Mar 2026 v1 https://arxiv.org/abs/2603.00991v1 , last revised 7 May 2026 this version, v2 Title:Tracking Capabilities for Safer Agents View PDF https://arxiv.org/pdf/2603.00991 HTML experimental https://arxiv.org/html/2603.00991v2 Abstract:AI agents that interact with the real world through tool calls pose fundamental safety challenges: agents might leak private information, cause unintended side effects, or be manipulated through prompt injection. To address these challenges, we propose to put the agent in a programming-language-based "safety harness": instead of calling tools directly, agents express their intentions as code in a capability-safe language: Scala 3 with capture checking. Capabilities are program variables that regulate access to effects and resources of interest. Scala's type system tracks capabilities statically, providing fine-grained control over what an agent can do. In particular, it enables local purity, the ability to enforce that sub-computations are side-effect-free, preventing information leakage when agents process classified data. We demonstrate that extensible agent safety harnesses can be built by leveraging a strong type system with tracked capabilities. Our experiments show that agents can generate capability-safe code with no significant loss in task performance, while the type system reliably prevents unsafe behaviors such as information leakage and malicious side effects. Submission history From: Yichen Xu view email https://arxiv.org/show-email/dce1652d/2603.00991 Sun, 1 Mar 2026 08:39:37 UTC 4,774 KB \ v1\ https://arxiv.org/abs/2603.00991v1 v2 Thu, 7 May 2026 14:09:04 UTC 4,781 KB References & Citations Loading... Bibliographic and Citation Tools Bibliographic Explorer What is the Explorer? https://info.arxiv.org/labs/showcase.html arxiv-bibliographic-explorer Connected Papers What is Connected Papers? https://www.connectedpapers.com/about Litmaps What is Litmaps? https://www.litmaps.co/ scite Smart Citations What are Smart Citations? https://www.scite.ai/ Code, Data and Media Associated with this Article alphaXiv What is alphaXiv? https://alphaxiv.org/ CatalyzeX Code Finder for Papers What is CatalyzeX? https://www.catalyzex.com DagsHub What is DagsHub? https://dagshub.com/ Gotit.pub What is GotitPub? http://gotit.pub/faq Hugging Face What is Huggingface? https://huggingface.co/huggingface ScienceCast What is ScienceCast? https://sciencecast.org/welcome Demos Recommenders and Search Tools Influence Flower What are Influence Flowers? https://influencemap.cmlab.dev/ CORE Recommender What is CORE? https://core.ac.uk/services/recommender arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs https://info.arxiv.org/labs/index.html .