Caper — command approval based on observed consequences

TL;DR

Caper pre-executes commands in a snapshotted sandbox and gives an independent approver a bounded effects report. Authors report fewer harmful outcomes than six compared systems; the harmful-outcome rate remains nonzero. (source)

Authors & Org

Weiheng Wu, Junkai Chen, Zhensu Sun, Jieke Shi, Yunbo Lyu and David Lo. Affiliations are not established by the reviewed abstract page. First submitted 2026-10-29. (source)

Method

The system evaluates the effects of invoked code in the current workspace rather than judging command text alone. It commits allowed commands and rolls back blocked ones, returning a reason the agent can use. (source)

Results

• SABER harmful-outcome rate: 6.7%, versus at least 14.8% for the compared systems. (source)
• YoloFS-Ext harmful-outcome rate: 7.8%, versus at least 35.3%. This author-built benchmark hides harmful behavior inside invoked tools. (source)
• Caper blocks 1.0% of the safe twins of dangerous YoloFS-Ext tasks. This denominator is not all benign coding work. (source)

Significance

For Agent Runtime Containment, observed effects supply evidence that command strings can omit. Interpretation: this complements policy checks such as LeanGuard — checking policy before tool execution; the papers do not establish a shared head-to-head evaluation. (source) (policy checks)

Open Questions

The abstract does not quantify execution overhead or establish which external side effects a sandbox can reproduce and roll back. Its benchmark results do not establish complete protection for production systems. Full paper and code were not reviewed. (source)

Cite

"Shall We Approve?" Consequence-Aware Approval for Autonomous Coding Agents

arXiv:2610.40753, first submitted 2026-10-29. (source)