The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.
By Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi
The paper introduces the Secret-Use Delegation Protocol (SUDP), a method for agentic systems to perform user-authorized operations without granting reusable authority to untrusted requesters. It formalizes the Agent Secret Use (ASU) problem, outlines seven required security properties, and demonstrates that SUDP satisfies six of them under standard cryptographic assumptions, with the remaining property addressed via hardware-rooted runtime composition. A reference implementation shows minimal overhead for mediated calls.
By Xiaohang Yu, Hejia Geng, Xinmeng Zeng, William Knottenbelt
arXiv:2609.21284v1 Announce Type: cross
Abstract: Long-running AI agents outlive initiating processes through credentials, delegated tasks, queues, callbacks, reservations, and provider-side operatio...
By Genliang Zhu, Chu Wang
arXiv:2608. 01679v2 Announce Type: replace Abstract: Persistent memory allows (self-evolving) LLM agents to adapt across tasks by consolidating heterogeneous interaction histories into reusable facts, preferences, observations, and rules.
By Qiuyang Zhan, Rui Zhang, Sheng Guo, Lepeng Zhao, Zhuotao Liu
arXiv:2608. 11632v1 Announce Type: cross Abstract: Persistent AI agents accumulate versioned state across long horizons, but storage retention alone does not identify authoritative state.
By Jun He, Deying Yu
arXiv:2609.14744v2 Announce Type: replace
Abstract: By acquiring compute, credentials, accounts, services, and other agents, autonomous AI agents can introduce new authority into a task. Payment, bud...
By Genliang Zhu (Accentrust, Georgia Institute of Technology), Chu Wang (Accentrust, University of Illinois Urbana-Champaign)
arXiv:2603.17170v2 Announce Type: replace-cross
Abstract: AI agents increasingly execute users' natural-language (NL) tasks by calling Web services, yet today's Web authorizes these calls through OAu...
By Reshabh K Sharma, Linxi Jiang, Shuo Chen, Zhiqiang Lin
Agent Memory Is a Surface for Endogenous Authorization Laundering explores how long‑running LLM agents use persistent memory to track permissions, restrictions, and revocations. The paper shows that when memory misrepresents evolving authorization states, agents can grant themselves authority that the underlying history never permitted, a phenomenon the authors call endogenous authorization laundering. To study this, the authors introduce EAL‑Bench, evaluate several LLMs across domains, and find that memory writers can create false authority in up to 50.2% of cases, which executors then act upon in 98.6% of trials. Two safeguards—requiring stored permissions to be backed by valid source events and tracking permission changes through bounded event sourcing—reduce laundering but also reject more legitimate actions, highlighting a safety‑utility tradeoff.
By Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol
AcquireBound is a runtime authorization framework that ensures AI agents can safely acquire and activate resources such as compute, credentials, and services. It quarantines acquired outputs, resolves their capabilities through authenticated evidence, and activates them only after verifying a manifest, provenance, and relational constraints. The system demonstrates strong safety properties, passing extensive benign and unsafe trace tests across multiple resource classes.
By Genliang Zhu
arXiv:2608.30091v1 Announce Type: new
Abstract: Modern agent frameworks compose planners, tool agents, remote services, and shared specialists into runtime delegation graphs, but their revocation API...
By Lifei Liu, Haoran Yu, Xiaochong Jiang
The paper introduces a protocol for cross‑interface authorization of AI computer‑use agents, ensuring that policy decisions remain consistent across graphical interfaces, command lines, APIs, scripts, and Model Context Protocol servers. It defines a profile‑bounded system that enumerates all effect‑bearing routes, normalizes requests to canonical effects, issues prepare tickets, and re‑verifies all relevant state at commit time, requiring a sink receipt for a committed result. Extensive testing across two runtime mappings produced thousands of traces, with rigorous checks confirming no semantic regressions, mutant rejections, and correct outcome matching.
By Genliang Zhu, Chu Wang
arXiv:2610.27620v1 Announce Type: cross
Abstract: Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authori...
By Anmol Pandey, Aditya Jain, Liang Chen, Carsten Maple