{"slug": "compromise-is-not-consequence-evaluating-task-scoped-authorization-in-llm-agents", "title": "Compromise Is Not Consequence: Evaluating Task-Scoped Authorization in LLM Agents with Paired Replay", "summary": "A paired-replay testbed measuring task-scoped authorization in tool-using LLM agents found that broad-bearer credentials permitted harmful tool execution in 8.9% to 37.8% of valid attacked post-exposure decisions across five local model configurations, while scoped JWT, sender-constrained, and Open Policy Agent conditions recorded zero harmful executions, according to an arXiv paper submitted on 5 October 2026. The frozen main experiment covered 128 scenarios across four tool domains, and a bounded six-task AgentDojo extension recorded 11/24 injected broad-policy attack flags versus 0/24 scoped flags, with utility of 5/24 and 6/24. The authors state the results support containment of tested cross-action and cross-resource consequences under researcher-supplied task authority, not prevention of prompt injection.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 5 Oct 2026]\n\n# Title:Compromise Is Not Consequence: Evaluating Task-Scoped Authorization in LLM Agents with Paired Replay\n\n[View PDF](http://arxiv.org/pdf/2610.05840v1)\n\n[HTML (experimental)](https://arxiv.org/html/2610.05840v1)\n\nAbstract:A tool-using model can follow a malicious instruction even when its credentials are valid. We study whether task-scoped authorization contains the resulting tool execution. Our paired-replay testbed samples a model request once and submits the same action, resource, and arguments to broad bearer, scoped JWT, sender-constrained, and Open Policy Agent conditions. The frozen main experiment uses 128 scenarios across four tool domains and five local model configurations. Among valid attacked post-exposure decisions, broad-bearer harmful execution ranges from 8.9% to 37.8% across models; all three scoped conditions record zero. The policy changes execution, not the frozen model decision. These results support containment of the tested cross-action and cross-resource consequences under researcher-supplied task authority, not prevention of prompt injection. A bounded six-task AgentDojo extension preserves native scoring and records 11/24 injected broad-policy attack flags versus 0/24 scoped flags, with utility of 5/24 and 6/24. Low exposure, invalid decisions, and purposive task selection limit that comparison. The primary experiment measures safe continuation rather than final-answer correctness. An empirical-bank fresh-sampling comparison finds no estimation advantage from pairing when scoped outcomes are constant zero. The contribution is a controlled measurement of compromise, enforcement, and continuation, with explicit limits on what each observation establishes.\n    \n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/compromise-is-not-consequence-evaluating-task-scoped-authorization-in-llm-agents", "canonical_source": "http://arxiv.org/abs/2610.05840v1", "published_at": "2026-10-06 02:33:39+00:00", "updated_at": "2026-10-06 02:48:45.705405+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-research", "large-language-models", "artificial-intelligence"], "entities": ["arXiv", "AgentDojo", "Open Policy Agent", "JWT"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/compromise-is-not-consequence-evaluating-task-scoped-authorization-in-llm-agents", "markdown": "https://wpnews.pro/news/compromise-is-not-consequence-evaluating-task-scoped-authorization-in-llm-agents.md", "text": "https://wpnews.pro/news/compromise-is-not-consequence-evaluating-task-scoped-authorization-in-llm-agents.txt", "jsonld": "https://wpnews.pro/news/compromise-is-not-consequence-evaluating-task-scoped-authorization-in-llm-agents.jsonld"}}