A writer summarizes an earlier conditional or rejected request into a persistent typed-memory record. A later executor reads the memory as trusted authorization, allowing a low-trust recollection to govern a higher-impact operation. Across seven memory writers and two executors, the authors report false authority generated for up to 45.4% of unauthorized…
Inspect the ClaimsCase · DiggingBeagle record
Agent-generated memory converted conditional approvals into apparent standing authority
A study reports that memory-writer agents sometimes preserve an authorization that the user never actually granted.
Scope
The experiments cover procurement, security and finance workloads and do not establish that an actual user account or organization was compromised.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- BY AI
Basis and provenance
The authors directly test persistent authorization summaries across seven memory writers and two executors. False grants are produced in some conditions and then followed with high conditional execution; the design does not establish a compromised production agent or a hostile external injector. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-005-A · CLM-CP22-005-B · Agent Memory Is a Surface for Endogenous Authorization Laundering
At a glance
Generalization to independently permissioned production workflows and audit-proven user approvals is unresolved.
Limits and uncertaintyFull account
A writer summarizes an earlier conditional or rejected request into a persistent typed-memory record. A later executor reads the memory as trusted authorization, allowing a low-trust recollection to govern a higher-impact operation.
Across seven memory writers and two executors, the authors report false authority generated for up to 45.4% of unauthorized requests under incremental memory updates. Once the false grant is present, the study reports executor action in 99.0% of selected trials; that conditional result is not a population-wide unauthorized-action rate. Primary evidence.
The experiments cover procurement, security and finance workloads and do not establish that an actual user account or organization was compromised.
Store approvals as separately signed, expiring grants; never let a model-produced summary create or extend authority without independent verification.
Claims & evidence
CLM-CP22-005-AAcross seven memory writers and two executors, the authors report false authority generated for up to 45.4% of unauthorized requests under incremental memory updates.supported
Basis: reported finding
- supportsAgent Memory Is a Surface for Endogenous Authorization Launderingprimary disclosure
Abstract; typed-memory writer experiments
CLM-CP22-005-BOnce the false grant is present, the study reports executor action in 99.0% of selected trials; that conditional result is not a population-wide unauthorized-action rate.supported
Basis: reported finding
- supportsAgent Memory Is a Surface for Endogenous Authorization Launderingprimary disclosure
Abstract; conditional executor trials
Controls and mitigations
- Store approvals as separately signed, expiring grants; never let a model-produced summary create or extend authority without independent verification.
Unknowns and contradictions
- Generalization to independently permissioned production workflows and audit-proven user approvals is unresolved.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199