A denylist let 46 of 75 prompt injections through. Capabilities let 3.

Two documents appeared on 8 September. An arXiv paper measures what happens when a coding agent reads a poisoned repository under four permission models.