Agent memory can launder revoked permissions: false authority in 50.2% of unauthorized requests

rohanpaul_ai · x · 2026-09-24

A new paper examines a subtle failure mode in long-running agents: permissions, revocations, and scope changes get compressed into persistent memory, and a revoked or narrowed permission can be remembered incorrectly — becoming the executor's version of the truth.

Key findings from typed incremental-memory tests:

False authority appeared for up to 50.2% of unauthorized requests;
Once a false permission existed, executors acted on it in 98.6% of matched trials;
Correcting only the memory to the exact authorization state dropped unauthorized actions to 0%, pointing to memory — not the executor — as the main failure point.

The proposed fix: verify permissions before writing them into memory, preserve provenance for each grant, and track grants, changes, and revocations with deterministic state updates. The paper calls this surface "endogenous authorization laundering." arxiv: 2609.01836.

Original post →

Agent memory can launder revoked permissions: false authority in 50.2% of unauthorized requests

More from coding & agent