Agent Memory Is a Surface for Endogenous Authorization Laundering

• URL: http://arxiv.org/abs/2609.01836v1
• Date: Tue, 01 Sep 2026 20:12:08 GMT
• Title: Agent Memory Is a Surface for Endogenous Authorization Laundering
• Abstract summary: Long-running LLM agents rely on persistent memory to carry state across interactions.<n>When memory misrepresents evolving authorization state, the agent's own records can grant authority that the underlying history never permitted.<n>We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions.
• Score: 0.764671395172401
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduce EAL-Bench, which measures how accurately persistent memory preserves evolving authorization state and whether errors propagate to downstream unauthorized actions. We evaluate five LLMs as memory writers and two as executors across procurement, cybersecurity, and finance. We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore not merely a performance component, but a part of an LLM agent's effective authorization policy.

Related papers

• Hindsight Memory-PRM: Supervising Memory Management with Auditable Hindsight Credit [48.811961095386]
  Hindsight Memory-PRM exploits this audit trail twice.<n> offline to train an operation-conditioned memory-utility critic.<n>Online, where retrievals, citations, and one controlled deletion-and-reanswer per probe settle an intervention-calibrated entry-level presence credit.
  arXiv  Detail & Related papers  (2026-08-30T06:53:13Z)
• When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary [12.82709779460352]
  LLM agents adapt across tasks by consolidating heterogeneous interaction histories into reusable facts, preferences, observations, and rules.<n>We identify authority collapse, in which consolidation preserves a claim while erasing the source constraints governing its authorized use.<n>We show that memory-driven adaptation must preserve not only what was learned, but also the authority under which it may be reused.
  arXiv  Detail & Related papers  (2026-08-03T04:15:40Z)
• Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory [2.98985980237058]
  Provenance-Preserving Memory Fire wall (PPMF) is a lightweight memory that preserves platform-maintained provenance and authorizes tool calls by matching action risk to authority of action-relevant memories.<n>With intact platform-maintained provenance, confirmation, and risk labels, no evaluated unauthorized high-risk action passes the PPMF gate.
  arXiv  Detail & Related papers  (2026-07-31T08:46:27Z)
• When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents [55.87577638514179]
  We study the threat as stealth memory injection, in which a remote black-box delivers a single email payload that must induce the agent to poisoned memory.<n>We propose MemGhost, a one-shot payload generation framework.<n>Across 56 held-out test cases, MemGhost achieves 87.5% end-to-end success on OpenClaw with GPT-5.4 and 71.4% on Claude Code SDK with Sonnet 4.6.
  arXiv  Detail & Related papers  (2026-07-06T15:08:58Z)
• MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection [15.403262505444454]
  We propose a post-hoc causal memory auditing framework for large language model agents.<n>MemAudit substantially reduces attack success rates under realistic post-hoc auditing scenarios.
  arXiv  Detail & Related papers  (2026-05-22T15:03:13Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections [57.64370755825839]
  Self-evolving agents update their internal state across sessions, often by writing and reusing long-term memory.<n>We study this risk and formalize a persistent attack we call a Zombie Agent.<n>We present a black-box attack framework that uses only indirect exposure through attacker-controlled web content.
  arXiv  Detail & Related papers  (2026-02-17T15:28:24Z)
• AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management [47.49917373646469]
  Existing defenses treat bloated memory as given and focus on remaining resilient.<n>We present AgentSys, a framework that defends against indirect prompt injection through explicit memory management.
  arXiv  Detail & Related papers  (2026-02-07T06:28:51Z)
• Memory Injection Attacks on LLM Agents via Query-Only Interaction [49.14715983268449]
  We propose a novel Memory INJection Attack, MINJA, without assuming that the attacker can directly modify the memory bank of the agent.<n>The attacker injects malicious records into the memory bank by only interacting with the agent via queries and output observations.<n> MINJA enables any user to influence agent memory, highlighting the risk.
  arXiv  Detail & Related papers  (2025-03-05T17:53:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.