# 智能体记忆可致权限洗白，最高50.2%越权

- 来源：Rohan Paul (@rohanpaul_ai)
- 发布时间：2026-09-24 21:01
- AIHOT 分数：40
- AIHOT 链接：https://aihot.news/items/cmufjux8704psro6oedoohmnp
- 原文链接：https://x.com/rohanpaul_ai/status/2103107433098789093

## AI 摘要

论文研究长时运行智能体的记忆权限失效问题：权限、撤销与范围变更被压缩进持久记忆后，被撤销或收窄的权限可能被记错，成为执行器的“事实”。在类型化增量记忆测试中，最高50.2%的未授权请求出现虚假权限，一旦存在，执行器在98.6%的匹配试验中照此行动；仅将记忆改为正确授权状态，未授权操作即降至0%。修复方向是写入记忆前校验权限、保留权限来源，并用确定性状态更新追踪授权、变更与撤销。

## 正文

An agent can make a perfectly consistent authorization decision and still be wrong if its memory has already rewritten who is allowed to do what.

This paper studies that failure in long-running agents, where permissions, revocations, and scope changes get compressed into persistent memory.

A revoked or narrowed permission can be remembered incorrectly, and that bad memory becomes the executor’s version of the truth.

In the paper’s typed incremental-memory tests, false authority appeared for up to 50.2% of unauthorized requests. Once that false permission existed, executors acted on it in 98.6% of matched trials.

Changing only the memory to the exact authorization state dropped those unauthorized actions to 0%. That points to memory, not the executor, as the main failure point in these cases.

The fix is to verify permissions before writing them into memory, preserve where each permission came from, and track grants, changes, and revocations with deterministic state updates.

– arxiv. org/abs/2609.01836

Title: "Agent Memory Is a Surface for Endogenous Authorization Laundering"