arXiv cs.AI· Weiheng Wu, Junkai Chen, Zhensu Sun, Jieke Shi, Yunbo Lyu, David Lo·· 1 天前AI 评分39
Caper：面向自主编码智能体的后果感知审批机制
"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents
AI 导读
研究者提出 Caper，一种后果感知的审批机制：在快照沙箱中预执行每条命令，把观察到的实际影响以受限报告交给独立审批器，放行则提交、拦截则回滚并给出可操作理由。在 SABER 上其有害结果率为 6.7%，低于六个对比系统中最少 14.8% 的水平；在自建基准 YoloFS-Ext 上为 7.8%，对比系统至少 35.3%，同时仅拦截 1.0% 的安全孪生任务。
正文 · 原文
Abstract:Coding agents increasingly rely on automated approvers to decide whether a proposed shell command may run. Existing approvers, from rule-based checkers to guardrail models and deployed permission classifiers, base their decisions on the text of the request and command. Yet a command's behavior depends on the code it invokes and the state of the workspace, and systems that observe file changes leave the assessment to the agent or a human after execution. We present Caper, a consequence-aware approval mechanism that pre-executes each command in a snapshotted sandbox, provides an independent approver with a bounded report of its observed effects, commits allowed commands, and rolls back blocked ones with a reason the agent can act on. Compared with six existing systems, Caper achieves the lowest harmful-outcome rate on SABER (6.7% versus at least 14.8%) and YoloFS-Ext, a benchmark we build in which harmful behavior is hidden inside invoked tools (7.8% versus at least 35.3%), while blocking 1.0% of the safe twins of the dangerous tasks in YoloFS-Ext.
| Comments: | 24 pages, 9 figures |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.40753 [cs.CR] |
| (or arXiv:2610.40753v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.40753 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Weiheng Wu [view email]
[v1]
Thu, 29 Oct 2026 16:20:20 UTC (440 KB)
来源：arXiv cs.AI · arxiv.org