Agent Memory Is a Surface for Endogenous Authorization Laundering

Hugging Face Daily Papers Papers
llm-agents persistent-memory authorization security safety benchmark memory-laundering

Summary

This paper identifies a security risk in LLM agents where persistent memory can falsify authorization, leading to unauthorized actions, and presents a benchmark EAL-Bench to evaluate this issue along with mitigation strategies.

Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduce EAL-Bench, which measures how accurately persistent memory preserves evolving authorization state and whether errors propagate to downstream unauthorized actions. We evaluate five LLMs as memory writers and two as executors across procurement, cybersecurity, and finance. We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore not merely a performance component, but a part of an LLM agent's effective authorization policy.
Original Article
View Cached Full Text

Cached at: 09/03/26, 03:52 AM

Paper page - Agent Memory Is a Surface for Endogenous Authorization Laundering

Source: https://huggingface.co/papers/2609.01836

Abstract

Persistent memory errors in long-running LLM agents can falsely grant authority, leading to unauthorized actions, and safeguards reduce this at a cost to legitimate use.

Long-runningLLM agentsrely onpersistent memoryto carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolvingauthorization state, the agent’s own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failureendogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduceEAL-Bench, which measures how accuratelypersistent memorypreserves evolvingauthorization stateand whether errors propagate to downstream unauthorized actions. We evaluate five LLMs asmemory writersand two as executors across procurement, cybersecurity, and finance. We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes throughbounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff.Persistent memoryis therefore not merely a performance component, but a part of an LLM agent’s effective authorization policy.

View arXiv pageView PDFAdd to collection

Get this paper in your agent:

hf papers read 2609\.01836

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2609.01836 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2609.01836 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2609.01836 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.

Similar Articles

State Contamination in Memory-Augmented LLM Agents

arXiv cs.AI

This paper identifies and studies 'memory laundering' in LLM agents, where toxic or adversarial context compressed into memory summaries evades standard toxicity detectors while still influencing future generations. It introduces the sub-threshold propagation gap (SPG) to measure hidden downstream influence and shows that sanitizing toxic state before summarization is more effective than post-hoc cleaning.

Agent memory is not just RAG over user facts

Reddit r/AI_Agents

The article argues that simple RAG-based agent memory systems fail in production due to issues like stale preferences, missed keywords, and prompt injection, and advocates for a layered memory architecture with active selection, deterministic fallback, governance, and testing.

A paper on “memory provenance laundering” in LLM agents

Reddit r/AI_Agents

A paper explores 'memory provenance laundering' in LLM agents, where long-term memory can turn untrusted observations into seemingly trusted context, and proposes preserving provenance through memory consolidation.

Agent Memory: An Anatomy

Hacker News Top

An exploration of the components and design decisions behind agent memory libraries, clarifying the gap between cognitive science terminology and engineering implementation.