{"id":"https://openalex.org/W7162539990","doi":"https://doi.org/10.48550/arxiv.2605.26542","title":"ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation","display_name":"ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation","publication_year":2026,"publication_date":"2026-05-26","ids":{"openalex":"https://openalex.org/W7162539990","doi":"https://doi.org/10.48550/arxiv.2605.26542"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.26542","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.26542","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.26542","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5030696708","display_name":"Xiaochong Jiang","orcid":"https://orcid.org/0009-0003-8343-6394"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Xiaochong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126714205","display_name":"Shiqi Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Shiqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137123392","display_name":"Ziwei Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Ziwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137105842","display_name":"Lifei Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Lifei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137182475","display_name":"Haoran Yu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu, Haoran","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137140525","display_name":"Yichen Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yichen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8705000281333923,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.8705000281333923,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.03550000116229057,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12203","display_name":"Mobile Agent-Based Network Management","score":0.01730000041425228,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/permission","display_name":"Permission","score":0.8618000149726868},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6194000244140625},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.4514000117778778},{"id":"https://openalex.org/keywords/proxy","display_name":"Proxy (statistics)","score":0.4250999987125397},{"id":"https://openalex.org/keywords/quality","display_name":"Quality (philosophy)","score":0.40700000524520874},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.3783000111579895},{"id":"https://openalex.org/keywords/password","display_name":"Password","score":0.3345000147819519},{"id":"https://openalex.org/keywords/value","display_name":"Value (mathematics)","score":0.31940001249313354}],"concepts":[{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.8618000149726868},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7495999932289124},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6486999988555908},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6194000244140625},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.4514000117778778},{"id":"https://openalex.org/C2780148112","wikidata":"https://www.wikidata.org/wiki/Q1432581","display_name":"Proxy (statistics)","level":2,"score":0.4250999987125397},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.40700000524520874},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3783000111579895},{"id":"https://openalex.org/C109297577","wikidata":"https://www.wikidata.org/wiki/Q161157","display_name":"Password","level":2,"score":0.3345000147819519},{"id":"https://openalex.org/C2776291640","wikidata":"https://www.wikidata.org/wiki/Q2912517","display_name":"Value (mathematics)","level":2,"score":0.31940001249313354},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.3165999948978424},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.311599999666214},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.29739999771118164},{"id":"https://openalex.org/C90673727","wikidata":"https://www.wikidata.org/wiki/Q901718","display_name":"Product (mathematics)","level":2,"score":0.29109999537467957},{"id":"https://openalex.org/C47487241","wikidata":"https://www.wikidata.org/wiki/Q5227230","display_name":"Data access","level":2,"score":0.29089999198913574},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.290800005197525},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.2827000021934509},{"id":"https://openalex.org/C11560541","wikidata":"https://www.wikidata.org/wiki/Q1756025","display_name":"Replay attack","level":3,"score":0.2818000018596649},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.27160000801086426},{"id":"https://openalex.org/C25343380","wikidata":"https://www.wikidata.org/wiki/Q277521","display_name":"Relation (database)","level":2,"score":0.262800008058548},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.26089999079704285},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.2538999915122986}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.26542","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.26542","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.26542","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.26542","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.793032705783844}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Tool-using":[0],"agents":[1,203],"increasingly":[2],"operate":[3],"in":[4,27,200],"open-ended":[5],"deployment":[6,168],"environments,":[7],"where":[8],"they":[9],"compose":[10],"file":[11],"systems,":[12],"web":[13],"APIs,":[14],"code":[15],"interpreters,":[16],"and":[17,38,53,82,160,193],"enterprise":[18],"services":[19],"at":[20],"runtime.":[21],"This":[22],"creates":[23],"a":[24,48,72,78,100,115,197],"safety":[25,189],"gap":[26,199],"tool":[28,83,101,127],"composition:":[29],"an":[30,41,58],"agent":[31,125],"can":[32,91],"satisfy":[33],"every":[34,75],"per-tool":[35],"permission":[36,66],"check":[37],"still":[39],"produce":[40],"unsafe":[42],"end-to-end":[43],"effect,":[44],"such":[45],"as":[46,96,114],"reading":[47],"confidential":[49],"document,":[50],"summarizing":[51],"it,":[52],"sending":[54],"the":[55,124,166],"summary":[56],"to":[57,123,146,180,186],"external":[59],"endpoint.":[60],"We":[61,111],"call":[62],"this":[63],"failure":[64],"mode":[65],"laundering.":[67],"ChainCaps":[68,113,139],"addresses":[69],"it":[70,97,104,156],"with":[71],"runtime":[73],"rule:":[74],"value":[76,90],"carries":[77],"sink-specific":[79],"capability":[80],"budget,":[81],"composition":[84,188],"propagates":[85],"budgets":[86],"by":[87],"intersection.":[88],"A":[89],"preserve":[92],"or":[93,126],"lose":[94],"authority":[95,108],"moves":[98],"through":[99,109],"chain,":[102],"but":[103],"cannot":[105],"gain":[106],"new":[107],"composition.":[110],"implement":[112],"transparent":[116],"MCP":[117],"proxy":[118],"that":[119],"requires":[120],"no":[121],"changes":[122],"servers.":[128],"On":[129],"82":[130],"tasks":[131],"across":[132],"five":[133],"frontier":[134],"models":[135],"from":[136,144],"three":[137],"providers,":[138],"reduces":[140],"attack":[141,174],"success":[142],"rate":[143],"25-68%":[145],"0-4.8%":[147],"while":[148,176],"preserving":[149],"96-100%":[150],"benign":[151],"completion.":[152],"In":[153],"replay":[154],"experiments,":[155],"also":[157],"outperforms":[158],"scalar-IFC":[159],"per-function-isolation":[161],"baselines.":[162],"Manifest":[163],"quality":[164],"is":[165],"dominant":[167],"bottleneck:":[169],"expert":[170],"manifests":[171,178,192],"reach":[172],"100%":[173],"blocking,":[175],"naive":[177],"fall":[179],"27.3%.":[181],"Our":[182],"claims":[183],"are":[184],"limited":[185],"explicit-flow":[187],"under":[190],"trusted":[191],"proxy-visible":[194],"data":[195],"movement,":[196],"practical":[198],"deployed":[201],"tool-using":[202],"today.":[204]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-28T00:00:00"}