[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-researchers-build-a-digital-twin-to-police-ai-coding-agents":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},9999,"researchers-build-a-digital-twin-to-police-ai-coding-agents","Researchers build a digital twin to police AI coding agents","A new framework called Pincer uses a per-user digital twin to approve or block an AI coding agent's resource requests, and it beats rival defenses in testing.","A research team has built a \"digital twin\" that decides, on the fly, what an AI coding agent is allowed to touch.\n\nThe paper describes Pincer, a defense that sits at the resource layer rather than the tool-call layer most existing safeguards operate on. It uses an isolated-context model, trained on a new user-centric dataset of multi-day user-agent transcripts, to learn an individual's preferences over time. That digital twin then acts as a stand-in for the user, approving or denying the permission requests a long-running coding agent makes as it works through a task. The researchers say this is needed because today's deployed agents, including Claude and Codex, mostly lean on user-maintained permission lists that decay or on automatic tool-call classifiers that were never built to catch adversarial setups and learn nothing user-specific.\n\nThe useful admission here is that permission fatigue is itself a security hole, not just an annoyance. Every \"always allow\" click from a tired developer becomes a permanent policy decision, and Pincer's bet is that a model quietly watching real behavior over days can approximate what a user would actually refuse, better than a static allowlist or a context-blind classifier can.\n\nThe paper benchmarks Pincer against several LLM-judge setups and against adaptations of Conseca, a resource-authorization system for agents proposed at HotOS 2025, and reports Pincer winning by wide margins on some attack types while still outperforming on the rest. That is a strong claim from one paper's own tests, and it will mean more once independent teams try to reproduce it.","[\"ai\",\"security\",\"ai-agents\",\"coding-agents\"]","2026-10-05T04:00:00.000Z","2026-10-05T17:31:24.043Z","2026-10-05T17:31:28.280Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The closing paragraph names 'Conseca' as a baseline without ever introducing what it is — add a brief parenthetical (e.g., a prior resource-authorization system from HotOS '25) the first time it appears, or cut the reference.","resolved","security",[32,30,33,34],"ai","ai-agents","coding-agents",[36],{"name":37,"url":38},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.02569",0,{"sections":41},[42,45,48,53,58,63,67,72,76,81,86,91,96,101],{"name":43,"slug":32,"count":44,"latest_published_at":18},"AI",6233,{"name":46,"slug":30,"count":47,"latest_published_at":18},"Security",868,{"name":49,"slug":50,"count":51,"latest_published_at":52},"Policy","policy",444,"2026-10-03T15:02:01.000Z",{"name":54,"slug":55,"count":56,"latest_published_at":57},"Deals","deals",323,"2026-10-04T13:00:00.000Z",{"name":59,"slug":60,"count":61,"latest_published_at":62},"Hardware","hardware",204,"2026-10-03T14:50:50.000Z",{"name":64,"slug":65,"count":66,"latest_published_at":18},"Science","science",177,{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",158,"2026-10-03T03:21:12.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":18},"Dev Tools","dev-tools",98,{"name":77,"slug":78,"count":79,"latest_published_at":80},"Software","software",97,"2026-10-04T10:00:00.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Startups","startups",92,"2026-10-04T14:36:25.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"Gaming","gaming",53,"2026-10-02T02:50:39.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"General","general",51,"2026-10-05T02:35:01.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",32,"2026-10-02T18:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",7,"2026-10-01T09:00:00.000Z"]