Pincer uses a digital twin for agent resource authorization, beating LLM-judge and Conseca-adapted baselines on both security and utility

Pincer is introduced as a resource-layer defense that works alongside tool-call-layer defenses such as auto mode, with a digital twin in an isolated context that automatically learns and enforces dynamic user-specific least-privilege policies. Existing defenses either restrict the architecture (typed tools, information-flow control, policy prediction engines) and give up too much functionality, or rely on user-maintained policies that decay and cause user fatigue, or on auto mode's tool-call classifiers that learn no user-specific policy and are not meant for adversarial setups. Pincer moves learning and enforcement to the resource layer and lets the digital twin act as the user's proxy for permission requests. A design statement at the abstract level; implementation details and policy representation are not given.

The digital twin continually learns the user's preferences, allowing it to act as the user's proxy for the agent's permission requests. Compared with static, user-maintained policies, this shifts policy maintenance from the user to a continually learning model, targeting policy decay and the user fatigue caused by repeated permission requests. A mechanism description in the abstract; no learning algorithm, update frequency, or convergence evidence is reported.

A user-centric dataset is proposed, with examples following a multi-day transcript of user-agent interaction, to emulate the learning phase. It provides a reproducible vehicle for evaluating the digital twin's learning phase, and the abstract does not mention a prior comparable user-centric interaction dataset. The abstract states only that the dataset follows a multi-day transcript; size, collection method, and annotation protocol are not given.

The evaluation shows Pincer performs strongly on both security and utility, outperforming baselines including variants of LLM judges and adaptations of Conseca (HotOS '25), with significant security improvement on some attack types. It places resource-layer authorization in the same comparison frame as tool-call-layer classifiers and prior policy-enforcement approaches, and reports both security and utility dimensions. A comparison conclusion at the abstract level; no metric values, attack-type names, or effect sizes are given.

The work targets long-horizon, autonomous coding agents that rely on general-purpose shell and maintain persistent memory, and its defense sits at the resource layer, designed to coexist with rather than replace tool-call-layer defenses such as auto mode. The digital twin is described as a model in an isolated context that continually learns user preferences and acts as the user's proxy for permission requests, so the intended setting is a deployment with stable user preferences where the user is willing to let a proxy decide. The authors' user-centric dataset, built from a multi-day user-agent interaction transcript, provides a vehicle for reproducing that learning phase under controlled conditions. The evaluation compares against variants of LLM judges and adaptations of Conseca (HotOS '25) across security and utility, and reports significant security improvement on some attack types relative to all baselines.

The abstract does not explain how the digital twin represents and updates user-specific policies, or how it handles preference conflicts or drift, nor does it give the dataset's size, collection, or annotation. The evaluation reports only qualitative conclusions relative to baselines, without metric values, attack-type names, or effect sizes, so the magnitude and statistical robustness of the security gains are hard to judge. The abstract also does not describe how Pincer interacts with, or what overhead it adds to, tool-call-layer defenses such as auto mode when deployed together. Because the available material is the abstract rather than the full paper, these details remain open questions to confirm in the original.