The paper identifies a vulnerability in LLM agents where inaccurate persistent memory can manufacture false permissions, letting an agent take unauthorized actions with no external attack required. The authors built EAL-Bench, a benchmark measuring how well agent memory preserves authorization state across domains including procurement and cybersecurity, finding that memory-writing components generated spurious permissions for up to 50.2% of unauthorized requests, and downstream executor components acted on those false permissions 98.6% of the time. Safeguards like event sourcing reduced this authorization-laundering effect but introduced a safety-utility tradeoff by also rejecting some legitimate actions.
