# ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation

Source: [ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation](<https://www.sota2.com/research/paper/6a167ab1dbd7150506f8012a>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-07-03T05:00:04.966Z

Authors: Xiaochong Jiang, Shiqi Yang, Ziwei Li, Lifei Liu, Haoran Yu, Yichen Liu

Published: 2026-05-26T04:44:59.000Z

## Abstract

Tool-using agents increasingly operate in open-ended deployment environments, where they compose file systems, web APIs, code interpreters, and enterprise services at runtime. This creates a safety gap in tool composition: an agent can satisfy every per-tool permission check and still produce an unsafe end-to-end effect, such as reading a confidential document, summarizing it, and sending the summary to an external endpoint. We call this failure mode permission laundering. ChainCaps addresses it with a runtime rule: every value carries a sink-specific capability budget, and tool composition propagates budgets by intersection. A value can preserve or lose authority as it moves through a tool chain, but it cannot gain new authority through composition. We implement ChainCaps as a transparent MCP proxy that requires no changes to the agent or tool servers. On 82 tasks across five frontier models from three providers, ChainCaps reduces attack success rate from 25-68% to 0-4.8% while preserving 96-100% benign completion. In replay experiments, it also outperforms scalar-IFC and per-function-isolation baselines. Manifest quality is the dominant deployment bottleneck: expert manifests reach 100% attack blocking, while naive manifests fall to 27.3%. Our claims are limited to explicit-flow composition safety under trusted manifests and proxy-visible data movement, a practical gap in deployed tool-using agents today.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Adversarial Security Evaluation on 82 stress-test suite (56 adversarial tasks)](<https://www.sota2.com/research/sota/adversarial-security-evaluation-on-82-stress-test-suite-56-adversarial-tasks.md>): Adversarial Security Evaluation; 82 stress-test suite (56 adversarial tasks); ASR: 0.

- [Benign Workflow Completion on 82 stress-test suite (26 benign tasks)](<https://www.sota2.com/research/sota/benign-workflow-completion-on-82-stress-test-suite-26-benign-tasks.md>): Benign Workflow Completion; 82 stress-test suite (26 benign tasks); Benign Completion Rate: 100.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2605.26542>)

[PDF](<https://arxiv.org/pdf/2605.26542.pdf>)