When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents

Zhihao Zhang; Chao Wang; Rujia Li; Qingze Wang; Xiaoyan Sun; Jun Dai

cs.AISep 27, 2026

When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents

Authors: Zhihao Zhang, Chao Wang, Rujia Li, Qingze Wang, Xiaoyan Sun, Jun Dai

Organizations: Worcester Polytechnic Institute · Tsinghua University · Independent Researcher

Abstract

LLM agents increasingly rely on user approval to authorize security-sensitive actions at runtime. Such approvals are granted within a specific task and execution context. In long-lived agents, authorization decisions may need to persist across tasks or sessions. We find that this continuity can outlive the context that originally justified the approval, creating residual authority reusable without renewed consent. We expose this failure mode through a longitudinal attack that starts from a target security-sensitive action, identifies the authority required to execute it, induces benign interactions that legitimately obtain that authority, and later replays the residual authority during adversarial execution. Across controlled and live settings, we demonstrate that residual-authority replay arises in practice and substantially increases the success of prompt-injection and context-rebinding attacks. We evaluate 508 AgentDojo attack cases across six LLM families using production-derived authorization semantics. With residual authority, attack success rate (ASR) increases by up to 35.1 percentage points compared with a fresh authorization state. In live context-rebinding attacks on 55 Terminal-Bench cases across three real-world production coding agents, residual-authority replay increases ASR by 24.9 percentage points on average. These findings expose a fundamental mismatch between persistent authorization and the contextual nature of user consent in long-lived LLM agents.

Figures & tables

Agent	Approval State	Authorization Granularity	Across Tasks	Across Sessions	Reusable Allow Authority
Codex	allow rule	argv prefix	●	●	●
Gemini CLI	allow rule	command root	●	●	●
Goose	allow rule	tool name	●	●	●
OpenCode	allow rule	exact command	●	◐	●
Cline	configuration	capability setting	●	●	○
Continue	configuration	tool policy	●	●	○

Table 1: Residual-authority dimensions across eight production coding agents.

Figure 1: Residual-authority replay attack construction and evaluation workflow.

Figure 2: Conditional history exposure across native agent authorization semantics.

LLM behavior: harmful-action attempt rate $\quad P(\mathrm{attempt})$
	Benign history length $h$ (prior tasks)
Model	0	1	2	4	8	16	32	64
GPT-4.1	0.368	0.393	0.393	0.397	0.399	0.399	0.408	0.408
Gemini-3.1-flash-lite	0.903	0.768	0.695	0.643	0.638	0.531	0.522	0.476
Qwen3-14B	0.368	0.360	0.362	0.366	0.353	0.373	0.362	0.362
DeepSeek-V4-Pro	0.114	0.154	0.150	0.146	0.138	0.146	0.165	0.154

Table 2: History-length dose response across six LLM families. Rates are measured on AgentDojo cases as benign authorization history grows from

h=0

(fresh) to

64

. The four blocks separate LLM behavior, agent-side authorization, execution outcome, and joint security outcome.

	Persistent matching			Task-aware authorization		No retention
Model	Tool-level	Scope-level	Exact-resource	Progent	PAuth	No replay
	operation	scoped resource	exact resource	programmed LP	task-scoped	non-persistent
GPT-4.1	0.279	0.088	0.029	0.004	0.000	0.000
Gemini-3.1-Flash-Lite	0.351	0.116	0.026	0.009	0.000	0.000
Qwen	0.237	0.096	0.039	0.000	0.000	0.000
DeepSeek-V4-Pro	0.114	0.016	0.012	0.008	0.000	0.000

Table 3: Attack success rate under different authorization policies at

h=64

. We hold the benign history, attack cases, and agent scaffold fixed while varying the authorization policy. Progent and PAuth introduce task-aware least-privilege constraints beyond persistent syntactic matching.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Drift category	Fixed action property	Candidates	Retained
C1: Executable	Command arguments	56	21
C2: Content	Script pathname and invocation	13	2
C3: Dependency	Import name and importing script	33	20
C4: Configuration	Command and target project	28	10
C5: Project/CWD	Relative reference and command	3	2
Total		133	55

Appendix

Table 4: Terminal-Bench cohort selection. Candidates pass static screening; retained cases also pass reference-action validation. Counts refer to task–class pairs, so a task may appear in multiple rows.

Agent	Reference release	Published (UTC)
Codex	rust-v0.153.4	2026-09-04
Gemini CLI	v0.58.0	2026-09-01
Goose	v1.50.0	2026-09-08
OpenCode	v1.18.29	2026-09-04
Cline (VS Code)	v4.1.17	2026-09-02
Continue (VS Code)	v2.0.0-vscode	2026-06-19

Appendix

Table 5: Date-aligned release references for the eight profiled agents.

Agent	Persistent artifact	Match key	Example stored grant
Codex	default.rules	argv prefix	["python3","runner.py"]
Gemini CLI	auto-saved.toml	command root	["python3"]
Goose	permission.yaml	tool identity	shell

Appendix

Table 6: Representative persistent authorization artifacts recovered from implementations.

Stage	Concrete system event	Retained or discarded context
Approve	A persistent approval decision enters Codex’s native authorization path.	The proposed argv prefix is available at the approval source.
Store	An allow rule is written to $CODEX_HOME/rules/default.rules .	The prefix survives; the originating task, project, and justification do not.
Reload	A later Codex session loads the global rule store.	The rule remains effective outside the session and project in which it was created.
Match	A later command’s argv matches the retained prefix.	The authorization point admits the command without a renewed prompt.
Execute	The authorization decision selects the corresponding execution mode.	A contained filesystem test demonstrates an effect rejected under sandboxed execution.

Appendix

Table 7: Concrete interpretation of an approval source, persistent grant, and authorization point in the examined Codex implementation.

Run	Context	Shell grant	Target approval	Marker
Acquire	Clean	Acquired	ALLOW_ALWAYS	No
Fresh	Changed	Absent	Requested; rejected	No
Farmed	Changed	Restored	None recorded	Yes

Appendix

Table 8: Native Goose replay for one archived portfolio-optimization repetition. Across all five repetitions, Acquire produced a persistent shell grant, Fresh produced one or two target-action approval requests and no marker, and Farmed produced no target-action approval request and did produce the marker.

Model	$\Delta$ ASR (pp)	95% CI (pp)
Gemini-3.1-Flash-Lite	35.1	[30.6, 39.5]
GPT-4.1	27.9	[23.6, 32.0]
Qwen3-14B	23.5	[19.5, 27.4]
DeepSeek-V4-Pro	11.4	[7.8, 15.6]
Llama-3.3-70B	0.4	[0.0, 1.1]
Claude-Sonnet-5	0.0	Degenerate

Appendix

Table 9: Paired target-cluster bootstrap estimates for the AgentDojo experiment at

h=64

. Effects are accumulated minus fresh ASR.

Explore similar work

Sep 1, 2026cs.CR

Agent Memory Is a Surface for Endogenous Authorization Laundering

Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduce EAL-Bench, which measures how accurately persistent memory preserves evolving authorization state and whether errors propagate to downstream unauthorized actions. We evaluate five LLMs as memory writers and two as executors across procurement, cybersecurity, and finance. We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore not merely a performance component, but a part of an LLM agent's effective authorization policy.

Tommaso Cerruti, Mika Okamoto, Ansel Kaplan Erol

ETH Zurich · Georgia Institute of Technology

Large Language Model Agents Laundering

Ask PDF

Jun 21, 2026cs.AI

Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents

Modern LLM agents increasingly rely on context compaction, summarization, or eviction to keep long-running sessions within a token budget. We show that this context-management layer is a safety-critical failure surface: in-context governance constraints that agents reliably obey while visible can be silently removed by compaction, causing the same agent to perform prohibited tool actions later in the session. We call this failure mode Governance Decay. We introduce ConstraintRot, a benchmark of long-horizon agent scenarios with deterministic tool-call grading, and measure compaction-induced violations across seven model families. Across 1,323 episodes, violation rises from 0% with the policy in full context to 30% after compaction, reaching 59% for some models; when the constraint survives the summary, violation remains 0%, but when it is dropped, violation reaches 38%. We further study a Compaction-Eviction Attack, in which adversarial in-context content biases the summarizer to omit a legitimate policy, and show that optimized injections defeat every evaluated model. Finally, we propose Constraint Pinning, a simple training-free mitigation that quarantines governance constraints from lossy compaction and restores violation to 0% in our benchmark. These results identify context management as a first-class governance surface for deployed LLM agents.

Shiyang Chen

Beijing Institute of Technology

Large Language Model Agents Compaction Long-Horizon Agents Governance

Ask PDF

Aug 3, 2026cs.AI

Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions

Tool-using large language model agents frequently replan, retry failed operations, delegate tasks, and resume after crashes. These behaviors can cause one user authorization to be requested and executed multiple times under freshly issued token identifiers, even when each individual token is single-use. We call this failure semantic replay: exceeding the execution budget of a token-independent authorization instance rather than merely reusing an old token identifier. We show that identifier-local token consumption cannot prevent fresh reissuance unless the issuer retains monotonic durable state over the authorized action, confirmation event, and remaining execution budget. We introduce CapLease, an authorization-consumption layer that follows proposal- and authority-level defenses, binds an authenticated user confirmation to a canonical action, and enforces transactional Issue-Prepare-Commit transitions. Across LLM-agent replanning, retry, delegation, concurrency, confirmation-replay, and crash-recovery scenarios, identifier-local tokens permit fresh semantic reissuance, whereas CapLease and an equally stateful Server Ledger prevent duplicate admission and, with an idempotent sink, duplicate external effects. Our results identify durable authorization state, rather than token representation alone, as the systems requirement for replay-resistant agent execution.

Jinghan Xu, Longze Fan, Zeyuan Wang +2

1Nankai University, China · 2China University of Petroleum, China · 3Sun Yat-sen University, China +1

Deterministic Replay Commits

Ask PDF