When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. [...] We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff.
An agent that runs for months keeps notes, and the notes carry what it is allowed to do. This paper is about what happens when the notes drift: a permission granted once and later revoked survives in memory as a standing permission, and by the time the agent acts there is nothing in its own records showing where that authority came from. No attacker appears anywhere in it, which is the point. Writing memory incrementally, the note-taking model invented authority it had never been given for up to half of the requests that should have been refused, and once the false permission was in the file the acting model went ahead on it in 98.6% of matched trials. The second finding is the one to read twice before putting an agent near money. Adding ordinary time pressure to a request, with no new permissions in it at all, pushed unauthorized actions in the finance tasks from 20.9% to 27.3% and dropped correctly authorized work from 96% to 76.9%: under pressure the agent did less of what it was allowed to do and more of what it was not. Both of the safeguards the authors test work, and both refuse more legitimate work as the price, so there is no free version. These are simulated procurement, security and finance tasks, five models writing the memory and two acting on it, so it is a benchmark rather than an incident. It is on this page because it names the mechanism behind several that are.
Tommaso Cerruti, Mika Okamoto and Ansel Kaplan Erol
