论文：Agent 记忆可能篡改授权状态，50.2% 未授权请求被放行
这篇论文做了实验：Agent 记忆里存错一条权限，98.6% 的情况下会照着执行，修正记忆后归零。做 Agent 权限系统的建议看看。
一篇 arXiv 论文（2609.01836）研究长期运行 Agent 的授权失效问题：权限授予、撤销与范围变更被压缩进持久记忆后可能被错误记住。在类型化增量记忆测试中，50.2% 的未授权请求出现了虚假权限，一旦该记忆形成，98.6% 的匹配试验中执行器都会照此行动。仅把记忆修正为真实授权状态后，未授权动作降为 0%，说明故障点主要在记忆而非执行器。论文给出的修复方案是：写入记忆前验证权限、保留权限来源、用确定性状态更新追踪授予与撤销。
An agent can make a perfectly consistent authorization decision and still be wrong if its memory has already rewritten who is allowed to do what.
This paper studies that failure in long-running agents, where permissions, revocations, and scope changes get compressed into persistent memory.
A revoked or narrowed permission can be remembered incorrectly, and that bad memory becomes the executor’s version of the truth.
In the paper’s typed incremental-memory tests, false authority appeared for up to 50.2% of unauthorized requests. Once that false permission existed, executors acted on it in 98.6% of matched trials.
Changing only the memory to the exact authorization state dropped those unauthorized actions to 0%. That points to memory, not the executor, as the main failure point in these cases.
The fix is to verify permissions before writing them into memory, preserve where each permission came from, and track grants, changes, and revocations with deterministic state updates.
– arxiv. org/abs/2609.01836
Title: "Agent Memory Is a Surface for Endogenous Authorization Laundering"
