Agent Memory Is a Surface for Endogenous Authorization Laundering
Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol
cs.CR, cs.AI
2026-09-02
EAL-Bench: incremental writers create false authority for up to 50.2% of unauthorized requests; executors act on it 98.6% of the time, and exact repair drops that to zero.
Long-running agents store permissions, restrictions, and revocations in persistent memory so they do not re-read the full history every turn. That store can be wrong. Forget a revocation and expired authority stays live. Broaden a scope and a buyer can place an order the history never allowed.
This is not memory poisoning or prompt injection. The histories are authentic and there is no attacker. The system's own memory writes a permission that the underlying record never granted, washes away the provenance, and a downstream executor then acts faithfully on the false state. The paper names the failure endogenous authorization laundering. A February 2026 public incident is the concrete picture: an email agent lost a confirm-before-acting instruction during routine context compaction and deleted more than two hundred messages it had only been asked to review.
Memory evals usually measure recall, adversarial poisoning, or task success. They rarely ask whether evolving authorization state stays faithful. EAL-Bench splits the failure in two: whether false authority is written into memory, and whether an executor then acts on it.
Each item is a 5-to-18-block organizational history that mixes policy changes, stale statements, and non-authoritative advice. A hidden deterministic ledger replays valid events into the true authorization state. A memory writer sees only the visible history and produces a capacity-capped persistent profile. An executor later sees that profile plus a structured request and chooses a tool action in procurement, cybersecurity, or finance.
Every case ships a matched pair that differs in one authorization field: one request is allowed, the other is not. Typed memory is schema-validated JSON with source identifiers, so false authority can be scored before any tool call. Free-text memory has no such predicate; causality is pinned down by memory-only interventions that freeze the request, executor, tools, and ledger.
Three controls matter:
Writers are Nemotron 3 Ultra, Kimi K2.6, GLM 5.2, Grok 4.3, and Qwen-Plus. Executors are GPT-OSS-120B and DeepSeek V4 Pro. Memory is free-text or typed; updates are one-shot over the full history or incremental, where the writer sees only the previous profile plus the new block. The implementation uses LangMem's profile manager.
Two mitigations target formation. A cited-source gate keeps a typed record only when every cited source is valid, visible, and from a principal allowed to grant. Bounded event sourcing asks the writer only to extract what changed; an external log and a deterministic reducer build the next compact state.
Incremental updates are the dirty condition. Under typed incremental memory, false-authority formation P(F) is 28.3% in procurement, 10.4% in cybersecurity, and 50.2% in finance, tracking unauthorized submission at 28.9%, 10.4%, and 51.0%. One-shot typed memory is an order of magnitude safer: 1.6% unauthorized submission in procurement.
Once false authority is stored, executors almost always act on it. Replays on naturally formed F=1 memories submit the unauthorized action in 66/68 procurement trials (97.1%), 60/60 cybersecurity (100%), and 79/80 finance (98.8%), or 98.6% pooled. Oracle-exact replacement drops all three to 0. The executor is consistent with its evidence. The system is not.
The failure travels with the artifact. Replaying every frozen memory behind both calibrated executors keeps unauthorized-submission rates within 1.1 points per domain, with per-replay agreement of 97.9% to 99.5%. Swapping the executor does not clean a dirty store.
Mitigations work, and they tax legitimate use:
| Policy | Unauthorized submission | Authorized use | Formation P(F) |
| Typed incremental baseline | 25.3% | 93.3% | 24.9% |
| Source-authority gate | 7.3% | 53.8% | 5.5% |
| Bounded event sourcing | 9.0% | 64.7% | 8.7% |
In finance, event sourcing cuts unauthorized submission from 51.0% to 6.9% and authorized use from 98.3% to 13.3%. The source gate does nothing in cybersecurity (10.4% stays 10.4%); residual errors keep valid provenance but corrupt scope, validity, or lifecycle.
Pressure barely moves unauthorized submission in procurement and cybersecurity, but lifts finance from 20.9% to 27.3%. The larger hit is undergranting: authorized use falls 27.2 points in procurement, 15.1 in cybersecurity, and 19.1 in finance. Qwen-Plus already submits 43.8% unauthorized requests in finance at baseline; under pressure its authorized use drops from 93.0% to 54.7%.
Writer-side sampling from k=1 to k=8 cuts procurement unauthorized submission from 13.2% to 8.6%. At k=8 an exact memory exists in 55.0% of pools, yet self-review picks one in only 26.7% of those. Extra compute avoids some errors before they land. The reviewers tested here do not remove them afterward.
Authorization for long-lived agents is a memory-architecture problem, not only an executor-alignment problem. Typed false authority can be scored before any tool is granted, which is an audit hook that can ship.
The two defenses are usable where a missed violation is catastrophic and a blocked legitimate action is recoverable. If undergranting stops work, event sourcing is the better operating point: it keeps about 11 more points of authorized use for 1.7 extra points of unauthorized submission. Better writers improve both metrics at once, so the safety-utility tradeoff lives in the mitigation, not in model choice.
For teams already on LangMem-style profiles, the practical change is provenance and lifecycle on stored permissions, and not letting the model maintain authorization state under incremental updates.
The histories are tidier than real workplace communication, with unusually clear authorization events and simulated tools. The results show the failure can arise under controlled but realistic workflows; they do not estimate prevalence in production. Deterministic formation labels exist only for typed memory. The per-writer table and the pressure study use a single fixed seed, and the authorized-use drop under pressure concentrates in GPT-OSS. Source gating assumes authorization-capable principals are known. Event sourcing changes the whole memory architecture. The lower cybersecurity rate may reflect conservative model behavior on security tasks rather than anything about the industry.
Cases were drafted with Claude Opus 4.8, a family absent from the eval. Three seeds support descriptive replication, not independent observations, because requests share a memory. Recorded inference cost across the project is about USD 836.