Open-source 'Pigeon' released for sub-task permission control in AI agents

Pigeon, an open-source tool designed to address the security vulnerability of copying and distributing full API keys when AI agents spawn sub-agents, has been released. Pigeon prevents privilege abuse by issuing signed credentials (Passes) to sub-agents that contain only permitted tasks and resources, rather than full permissions.

Core Features and Mechanism

Pigeon is a lightweight programming interface that operates without a server and works as follows:

• Delegate: The parent agent issues a Pass to the sub-agent containing only specific capabilities and resources.
• Verify: The Pass is verified before actual tool execution; unauthorized tasks are rejected and specific reason codes are returned.
• Prevention of Privilege Escalation: Sub-agents cannot expand the parent's permissions or relax constraints; attempts to do so are rejected.

Scope and Limitations

Pigeon integrates with MCP (Model Context Protocol) middleware to generate and verify narrowed Passes for each tool call. However, it does not block prompt injection and is designed as a security primitive that limits the blast radius only within the dimensions specified in the Pass.