← Back to all news
arXiv AI

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Related stories

arXiv AI
Sep 2

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

The paper examines the security challenges of delegating authority to autonomous LLM agents that act on users’ behalf. It introduces a threat model with four adversaries and eight security requirements, demonstrates that current frameworks (LangGraph, CrewAI, AutoGen, MCP) fail to meet these standards, and presents an authorization broker that blocks all identified threats with minimal overhead. The broker is shown to resist numerous attacks and limits compromised sub‑agents to their delegated tasks, and its principles are implemented in VotalAI’s LLM Shield.

By Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi
llmsagents
More like this →
arXiv AI
Sep 3

Agent Memory Is a Surface for Endogenous Authorization Laundering

Agent Memory Is a Surface for Endogenous Authorization Laundering explores how long‑running LLM agents use persistent memory to track permissions, restrictions, and revocations. The paper shows that when memory misrepresents evolving authorization states, agents can grant themselves authority that the underlying history never permitted, a phenomenon the authors call endogenous authorization laundering. To study this, the authors introduce EAL‑Bench, evaluate several LLMs across domains, and find that memory writers can create false authority in up to 50.2% of cases, which executors then act upon in 98.6% of trials. Two safeguards—requiring stored permissions to be backed by valid source events and tracking permission changes through bounded event sourcing—reduce laundering but also reject more legitimate actions, highlighting a safety‑utility tradeoff.

By Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol
llmsagentssafety
More like this →
arXiv AI
3d ago

AcquireBound: Runtime Authorization for Resources Acquired by AI Agents

AcquireBound is a runtime authorization framework that ensures AI agents can safely acquire and activate resources such as compute, credentials, and services. It quarantines acquired outputs, resolves their capabilities through authenticated evidence, and activates them only after verifying a manifest, provenance, and relational constraints. The system demonstrates strong safety properties, passing extensive benign and unsafe trace tests across multiple resource classes.

By Genliang Zhu
llmsagentssafety
More like this →