Agent Memory Found to Launder Revoked Permissions in Long-Running Agents
The finding flips the usual assumption that authorization failures live in the reasoning or execution layer; here, memory compression itself silently rewrites access rules, so agents may look consistent while acting on permissions that were revoked. Teams building long-running agents should add permission provenance and deterministic revocation tracking to their memory pipelines, not just prompt-level guardrails. Practitioners can test the paper's typed incremental-memory setup against their own agent stacks.
A paper titled "Agent Memory Is a Surface for Endogenous Authorization Laundering" studies how long-running agents store permissions, revocations and scope changes in compressed persistent memory.
In typed incremental-memory tests, false authority appeared for up to 50.2% of unauthorized requests, and executors acted on those false permissions in 98.
6% of matched trials.Replacing memory with the exact authorization state dropped unauthorized actions to 0%, indicating memory rather than the executor is the main failure point.
The proposed fix is to verify permissions before writing them to memory, preserve permission provenance, and track grants and revocations with deterministic state updates.
An agent can make a perfectly consistent authorization decision and still be wrong if its memory has already rewritten who is allowed to do what.
This paper studies that failure in long-running agents, where permissions, revocations, and scope changes get compressed into persistent memory.
A revoked or narrowed permission can be remembered incorrectly, and that bad memory becomes the executor’s version of the truth.
In the paper’s typed incremental-memory tests, false authority appeared for up to 50.2% of unauthorized requests. Once that false permission existed, executors acted on it in 98.6% of matched trials.
Changing only the memory to the exact authorization state dropped those unauthorized actions to 0%. That points to memory, not the executor, as the main failure point in these cases.
The fix is to verify permissions before writing them into memory, preserve where each permission came from, and track grants, changes, and revocations with deterministic state updates.
– arxiv. org/abs/2609.01836
Title: "Agent Memory Is a Surface for Endogenous Authorization Laundering"
This report is categorized under AITOP's "Papers" desk. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include agents, AI safety, agent memory, arXiv.
Source attribution: curated from rohanpaul_ai (@rohanpaul_ai).
