Authority Is Not a String: A Capability-Scoped Harness for Prompt-Injection-Resistant Coding Agents
Coding agents use system-level tools to read files, execute commands, and modify source code. Within the agent’s sandbox, these tools often carry ambient authority: naming a resource is sufficient to act on it. Indirect prompt injection exploits this authority by placing instructions in repository files or tool output...