AI agents that interact with the real world through tool calls pose fundamental safety challenges: agents might leak private information, cause unintended side effects, or be manipulated through prompt injection. To address these challenges, we propose to put the agent in a programming-language-based "safety harness": instead of calling tools directly, agents express their intentions as code in a capability-safe language: Scala 3 with capture checking. Capabilities are program variables that regulate access to effects and resources of interest. Scala's type system tracks capabilities statically, providing fine-grained control over what an agent can do. In particular, it enables local purity, the ability to enforce that sub-computations are side-effect-free, preventing information leakage when agents process classified data. We demonstrate that extensible agent safety harnesses can be built by leveraging a strong type system with tracked capabilities. Our experiments show that agents can generate capability-safe code with no significant loss in task performance, while the type system reliably prevents unsafe behaviors such as information leakage and malicious side effects.

翻译：通过工具调用与现实世界交互的AI智能体面临根本性安全挑战：智能体可能泄露隐私信息、引发非预期副作用，或受到提示注入攻击。针对这些问题，我们建议将智能体置于基于编程语言的"安全约束框架"中：智能体不再直接调用工具，而是以具有能力安全性的语言（支持捕获检查的Scala 3）表达其意图。能力作为程序变量，可调节对相关效应与资源的访问权限。Scala的类型系统可静态追踪能力，实现对智能体行为的细粒度控制，尤其具备局部纯净化能力——可强制子计算无副作用，从而在智能体处理涉密数据时防止信息泄露。实验表明，通过利用具备可追踪能力的强类型系统，能够构建可扩展的智能体安全约束框架。我们的实验显示：智能体生成能力安全代码时任务性能无显著损失，同时类型系统可可靠防范信息泄露与恶意副作用等不安全行为。