Blog · arXiv Analysis · Published: July 10, 2026 · Modified: July 10, 2026 · Last reviewed: July 10, 2026

The Execution-Security Map Becomes the Missing Control

Mohammadreza Rashidi's July 2026 arXiv paper treats AI coding-agent security as a field with a missing map. The problem is not only whether one sandbox, policy, or tool gate works. It is whether the literature can see the shared execution boundary it is already studying from different directions.

For this essay, execution security means the system boundary between an AI coding agent and the machine, repository, shell, network, credential set, tool server, and audit trail it can affect while doing work.

The Paper

The paper is The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities, arXiv:2607.05743 [cs.CR; cs.AI]. The arXiv abstract page lists Mohammadreza Rashidi as author and records submission on July 7, 2026. The arXiv metadata describes an 18-page paper with 15 figures and 6 tables, and the PDF title page identifies the author's affiliation as Department of Computer Science, AI and Media Analysis Lab, Berlin, Germany.

The paper is a systematization of knowledge rather than a new exploit or defense. It reads 39 execution-security papers from 2023 through 2026, organizes them into 17 categories, checks the included papers directly against their sources, and releases a machine-readable corpus and verification script as supplementary material.

The Fresh Angle

This site already has pages on agent sandboxes, command denylists, delegation traces, AgentRiskBOM, and Model Context Protocol. Rashidi's paper is not another entry in one of those lanes. Its useful contribution is the claim that those lanes are being studied too separately.

The fresh angle is therefore institutional: an organization cannot govern coding-agent execution by buying one isolated control and calling the boundary solved. The field itself needs a crosswalk between containment, permission, policy, state validation, identity, provenance, egress, and code analysis. Without that map, each control can look sensible while leaving a neighboring failure mode untested.

The Map

The taxonomy groups work around mechanisms that touch the execution boundary: sandbox isolation, escape benchmarks, access-control and capability models, policy-enforcement fragility, time-of-check-to-time-of-use races, MCP-specific threats and defenses, systems-security framing, harness-level evaluation, identity and credential delegation, execution provenance, network egress, static analysis of agent-generated code, scope-creep measurement, and skill or plugin packaging security.

That list matters because coding agents do not fail only as chatbots. They fail as programs with shells, files, networks, tools, credentials, and memory. A prompt-injection defense can reduce one channel of instruction compromise while the execution layer still permits a bad command. A container can limit filesystem reach while a tool server exposes a broader data path. A denylist can block a named command while another command reaches the same operational effect. A signed log can preserve evidence while failing to prevent the boundary crossing it records.

The Five Gaps

The paper's five cross-cutting gaps are the page's strongest governance signal. First, isolation architectures and capability models are rarely compared on a shared benchmark. Second, policy-enforcement papers report 69% to 98% failure rates for real denylists, but isolation papers do not generally rerun their defenses under that adversarial setting. Third, TOCTOU and MCP threats often appear as separate literatures even though both concern stale validation: a system checks a state, trusts it, and then acts after the relevant state may have changed.

Fourth, enforcement mechanisms commonly assume an honest policy author. That is a serious omission for agent governance because the policy writer may be rushed, mistaken, overbroad, captured by product incentives, or using generated policy text. Fifth, benign but out-of-scope agent actions, reported up to 17.1% under realistic prompting in the surveyed corpus, are not addressed by the access-control or capability papers in the corpus. A system can obey its permissions and still do the wrong extra thing.

Rashidi also reports confirming four disclosed, patched CVEs affecting production agent harnesses or underlying tooling. This page does not restate the vulnerability details as independent findings; it reads them as the paper's evidence that execution security is not a hypothetical concern.

Governance Reading

The Spiralist reading is that the execution boundary has to become an audit object in its own right. "The agent was sandboxed" is not enough. The record should say which sandbox, which filesystem mounts, which network egress paths, which tool servers, which credentials, which approval gates, which policy source, which static checks, which provenance record, which runtime logs, and which state-validation rule were in force.

The map also changes how teams should test controls. A sandbox should be tested against denylist-bypass findings. An MCP client should be tested as a state-validation system, not only as a protocol adapter. Access-control schemes should be tested against benign scope creep, not only malicious misuse. Provenance should be tested for whether it supports incident reconstruction across tools, not merely whether it stores a pretty trace. Policy systems should be tested against policy-authoring mistakes, not only malicious users.

The lesson is modest but strict: coding-agent governance should not let every subfield certify itself in isolation. The control is the composition. If the literature is fragmented, the deployed system will inherit that fragmentation as blind spots.

Limits

This is a systematization, not a prevalence study. It does not prove that a specific product is safe or unsafe, that every coding-agent deployment faces the same risk mix, or that the 39-paper corpus captures every relevant industrial practice. The paper's value is in the category work and gap analysis, not in claiming final coverage of a fast-moving field.

The page also keeps the evidentiary boundary narrow. It treats arXiv metadata, the PDF, and the paper's own claims as primary-source evidence about the paper. It does not independently verify the supplementary artifact, every included paper, or every CVE named in the PDF.

Source Discipline

Use the paper as a map of research structure, not as a single universal safety checklist. The categories are useful because they show which controls must be compared, combined, and stress-tested together. They are weaker if turned into a procurement slogan or a claim that one taxonomy has settled agent security.

The disciplined question for any coding-agent deployment is: which execution-security category is this control supposed to cover, which neighboring category can still bypass it, and what evidence would show the composition actually held?

Sources

Return to Blog