.</p>\n","updatedAt":"2026-09-03T00:26:05.602Z","author":{"_id":"65044901221035b9ee187178","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/65044901221035b9ee187178/o2LTLLIoT3T17Y4ZZZy_x.jpeg","fullname":"Tommaso Cerruti","name":"Cerru02","type":"user","isPro":false,"isHf":false,"isHfAdmin":false,"isMod":false,"followerCount":5,"isUserFollowing":false}},"numEdits":0,"identifiedLanguage":{"language":"fr","probability":0.32275810837745667},"editors":["Cerru02"],"editorAvatarUrls":["https://cdn-avatars.huggingface.co/v1/production/uploads/65044901221035b9ee187178/o2LTLLIoT3T17Y4ZZZy_x.jpeg"],"reactions":[],"isReport":false}}],"primaryEmailConfirmed":false,"paper":{"id":"2609.01836","authors":[{"_id":"6a98bc61fea818274321fdda","user":{"_id":"65044901221035b9ee187178","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/65044901221035b9ee187178/o2LTLLIoT3T17Y4ZZZy_x.jpeg","isPro":false,"fullname":"Tommaso Cerruti","user":"Cerru02","type":"user","name":"Cerru02"},"name":"Tommaso Cerruti","status":"claimed_verified","statusLastChangedAt":"2026-09-03T00:45:04.498Z","hidden":false},{"_id":"6a98bc61fea818274321fddb","name":"Mika Okamoto","hidden":false},{"_id":"6a98bc61fea818274321fddc","name":"Ansel Kaplan Erol","hidden":false}],"publishedAt":"2026-09-01T00:00:00.000Z","submittedOnDailyAt":"2026-09-02T00:00:00.000Z","title":"Agent Memory Is a Surface for Endogenous Authorization Laundering","submittedOnDailyBy":{"_id":"65044901221035b9ee187178","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/65044901221035b9ee187178/o2LTLLIoT3T17Y4ZZZy_x.jpeg","isPro":false,"fullname":"Tommaso Cerruti","user":"Cerru02","type":"user","name":"Cerru02"},"summary":"Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks.\n We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduce EAL-Bench, which measures how accurately persistent memory preserves evolving authorization state and whether errors propagate to downstream unauthorized actions.\n We evaluate five LLMs as memory writers and two as executors across procurement, cybersecurity, and finance. We find that under incremental memory updates, writers create false authority for up to 50.2% of unauthorized requests; once false authority is present, executors act on it in 98.6% of trials. Two safeguards, requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing, substantially reduce laundering, but both also reject more legitimate actions, exposing a safety-utility tradeoff. Persistent memory is therefore not merely a performance component, but a part of an LLM agent's effective authorization policy.","upvotes":3,"discussionId":"6a98bc62fea818274321fddd","ai_summary":"Persistent memory errors in long-running LLM agents can falsely grant authority, leading to unauthorized actions, and safeguards reduce this at a cost to legitimate use.","ai_keywords":["LLM agents","persistent memory","endogenous authorization laundering","EAL-Bench","bounded event sourcing","authorization state","memory writers"],"ai_summary_model":"thinkingmachines/Inkling-Small","organization":{"_id":"60347fbbe8149a962412a689","name":"EleutherAI","fullname":"EleutherAI","avatar":"https://cdn-avatars.huggingface.co/v1/production/uploads/1614054059123-603481bb60e3dd96631c9095.png"}},"canReadDatabase":false,"canManagePapers":false,"canSubmit":false,"hasHfLevelAccess":false,"upvoted":false,"upvoters":[{"_id":"65044901221035b9ee187178","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/65044901221035b9ee187178/o2LTLLIoT3T17Y4ZZZy_x.jpeg","isPro":false,"fullname":"Tommaso Cerruti","user":"Cerru02","type":"user"},{"_id":"63ac5701c21e60a3e9b58aa7","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/63ac5701c21e60a3e9b58aa7/g6EX7diOpuA94R2ab-rZC.png","isPro":true,"fullname":"Dipankar Sarkar","user":"dipankarsarkar","type":"user"},{"_id":"69bd161dc72e20286157e223","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/noauth/ly1ld8fcRubxmyeef4lzN.png","isPro":false,"fullname":"小林陽太","user":"victking72","type":"user"}],"acceptLanguages":["en"],"dailyPaperRank":0,"organization":{"_id":"60347fbbe8149a962412a689","name":"EleutherAI","fullname":"EleutherAI","avatar":"https://cdn-avatars.huggingface.co/v1/production/uploads/1614054059123-603481bb60e3dd96631c9095.png"},"markdownContentUrl":"https://huggingface.co/buckets/huggingchat/papers-content/resolve/2609/2609.01836.md","query":{}}">

hf papers read 2609.01836

curl -LsSf https://hf.co/cli/install.sh | bash