Caper pre-executes coding agent commands before approval
The point
Coding agents rely on automated approvers to decide whether a shell command may run. Existing approvers judge command text, but behavior depends on the code invoked and the workspace state.
Why it matters
For builders, approval can rest on observed effects instead of command text alone.
Key details
- It pre-executes commands in a snapshotted sandbox, commits allowed ones, and rolls back blocked ones
- On SABER: 6.7 percent harmful outcomes, versus at least 14.8 percent for compared systems
- On YoloFS-Ext: 7.8 percent versus at least 35.3 percent, blocking only 1.0 percent of safe twins
Original ~8 min → 25 sec here Source: arXiv cs.AI, Nov 2, 2026