When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. [...] We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. [...]
An agent that runs for months keeps notes, and the notes carry what it is allowed to do. This paper is about what happens when the notes drift: a permission granted once and later revoked survives in memory as a standing permission, and by the time the agent acts there is nothing in its own records showing where that authority came from. No attacker appears anywhere in it, which is the point. The finding that is not in the abstract is the one to read before putting an agent near money. Adding ordinary time pressure to a request, with no new permissions in it at all, pushed unauthorized actions in the finance tasks from 20.9% to 27.3% and dropped correctly authorized work from 96% to 76.9%. These are simulated procurement, security and finance tasks, so it is a benchmark rather than an incident. It is on this page because it names the mechanism behind several that are.
Tommaso Cerruti, Mika Okamoto and Ansel Kaplan Erol, in arXiv
