让 AI 先试跑再放行：命令安全的新思路
现在的 AI 编程助手要执行命令前，靠的是看命令文本猜危不危险——就像只看菜名判断一道菜会不会吃坏肚子。这篇换了个做法：在隔离沙箱里先把命令真的跑一遍，把实际产生的文件改动、网络访问等后果整理成报告，再决定放不放行。被拦下的命令还会附上具体原因，AI 能据此调整。在测试集上，有害结果率从至少 14.8% 降到 6.7%；当危险行为藏在被调用的工具内部时，优势更明显（7.8% 对至少 35.3%）。代价是每次批准前都要多跑一遍，速度会慢。它不是你明天就能装上的东西，但给「AI 自主行动的安全边界」指了个更靠谱的方向。
📄 原文摘要(英文)
Coding agents increasingly rely on automated approvers to decide whether a proposed shell command may run. Existing approvers, from rule-based checkers to guardrail models and deployed permission classifiers, base their decisions on the text of the request and command. Yet a command's behavior depends on the code it invokes and the state of the workspace, and systems that observe file changes leave the assessment to the agent or a human after execution. We present Caper, a consequence-aware approval mechanism that pre-executes each command in a snapshotted sandbox, provides an independent approver with a bounded report of its observed effects, commits allowed commands, and rolls back blocked ones with a reason the agent can act on. Compared with six existing systems, Caper achieves the lowest harmful-outcome rate on SABER (6.7% versus at least 14.8%) and YoloFS-Ext, a benchmark we build in which harmful behavior is hidden inside invoked tools (7.8% versus at least 35.3%), while blocking 1.0% of the safe twins of the dangerous tasks in YoloFS-Ext.