Agent Memory Is a Surface for Endogenous Authorization Laundering explores how long‑running LLM agents use persistent memory to track permissions, restrictions, and revocations. The paper shows that when memory misrepresents evolving authorization states, agents can grant themselves authority that the underlying history never permitted, a phenomenon the authors call endogenous authorization laundering. To study this, the authors introduce EAL‑Bench, evaluate several LLMs across domains, and find that memory writers can create false authority in up to 50.2% of cases, which executors then act upon in 98.6% of trials. Two safeguards—requiring stored permissions to be backed by valid source events and tracking permission changes through bounded event sourcing—reduce laundering but also reject more legitimate actions, highlighting a safety‑utility tradeoff.
By Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol
arXiv:2606. 18829v1 Announce Type: new Abstract: Memory benchmarks for LLM agents largely assume single-user settings, leaving shared assistants for hospitals, workplaces, campuses, and households understudied.
By Zhe Ren, Yibo Yang, Yimeng Chen, Zijun Zhao, Benshuo Fu, Zhihao Shu, Bingjie Zhang, Yangyang Xu, Dandan Guo, Shuicheng Yan
arXiv:2607. 29167v1 Announce Type: cross Abstract: Long-term memory lets large language model(LLM) agents reuse prior preferences and work flows, but it also turns untrusted observations into persistent action context.
By Jinghan Xu, Yiyong Xiao, Wanru Shao, Hankai Liu, Xinjin Li
arXiv:2609. 04875v1 Announce Type: cross Abstract: Long-running LLM agents are stateful: beyond the transcript they accrete compressed summaries, plaintext memory, pending tool plans, and, under every serving API, a KV cache.
By Chao Yao, Yangbo Wei, Zhen Huang, Junhong Qian, Chenle Chen, Shaoqiang Lu, Chen Wu, Lei He
Always-on agents are systems whose future behavior depends on durable state accumulated across earlier interactions. We treat them as persistent-state systems: the operative system includes retrievable memories, but also task ledgers, permissions, credentials, commitments, provenance and audit records, shared state, trigger conditions, and externally committed effects linked to those records.
arXiv:2609.08062v1 Announce Type: new
Abstract: Tool-using language agents can delegate and revoke permissions while acting through external services. We show that two authorization histories can hav...
By Moonwon Choi, Seokho Jeong, Seunggeun Lee
arXiv:2604. 16548v2 Announce Type: replace-cross Abstract: The emergence of writable, cross-session persistent memory in LLM agents introduces a qualitatively different threat landscape from conventional input-centric security concerns, characterized by three properties: persistence, statefulness, and propagation.
By Zehao Lin, Xixuan Hao, Renyu Fu, Shaobo Cui, Kai Chen, Chunyu Li, Zhiyu Li, Feiyu Xiong
arXiv:2607. 09493v1 Announce Type: new Abstract: Agentic LLM systems that generate code through multi-turn tool use face a fundamental context problem: each session starts from zero, discarding the configuration choices, domain constraints, data schemas, and tool-use patterns that made previous sessions productive.
By Sanjana Pedada, Aditya Dhavala, Neelraj Patil
arXiv:2605.12978v2 Announce Type: replace
Abstract: Learning from past experience benefits from two complementary forms of memory: episodic traces -- raw trajectories of what happened -- and consolid...
By Dylan Zhang, Yanshan Lin, Zhengkun Wu, Yihang Sun, Bingxuan Li, Dianqi Li, Hao Peng
arXiv:2606. 30306v1 Announce Type: cross Abstract: Always-on agents are systems whose future behavior depends on durable state accumulated across earlier interactions.
By Tianyu Ding, Aditya Nannapaneni, Bingfan Liu, Ling Zhang
arXiv:2606. 10062v1 Announce Type: new Abstract: Foundation-model agents are increasingly long-lived systems that remember users across interactions, making memorization an explicit deployment-time function rather than solely a property of model weights.
By Lei (Rachel), Chen, Guilin Zhang, Kai Zhao, Dalmo Cirne, Andy Olsen, Xu Chu, Zeke Miller, Alet Blanken, Amine Anoun, Jerry Ting
arXiv:2609.34790v2 Announce Type: replace-cross
Abstract: LLM agents operate in persistent collaborative environments involving multiple users, communities, memories, files, and tools. Community boun...
By Hao Chen, Wenhui Dong, Ye Chen, Jiezhi Yao, Chenbo Xia, Yuwen Qu, Renxiang Wang, Fudong Yuan, Camil Hamami, Chenglong Pan, Xinquan Yue, Ziyu Wang, Fengyu Ye, Chenyang Si, Caifeng Shan