FlagThis

Abstract

Tool-using agents in open-ended deployment environments face a safety gap called "permission laundering," where individually authorized tool calls can be composed to produce an unsafe end-to-end effect, such as exfiltrating confidential data to an external endpoint. ChainCaps addresses this by implementing a runtime rule where every value carries a sink-specific capability budget, and tool composition propagates these budgets via intersection. This ensures that a value can preserve or lose authority as it moves through a tool chain, but it cannot gain new authority. Implemented as a transparent MCP proxy, ChainCaps significantly reduces attack success rates across various frontier models while maintaining high benign completion rates.