Evidence record EV-0015

Approvals that outlive their task raise attack success

A preprint reports that approvals persisted beyond the context that justified them raised prompt-injection attack success by up to 35.1 percentage points on 508 AgentDojo cases, and by 24.9 points on average in live tests on three production coding agents.

Preprint · Measurement · Retrieved

Evidence class: Preprint. Unreviewed. Many are by one author or a small team, and some authors have a stake in the result. Most AX research is in this class today. Pattern tags: approval, prompt-injection.

Effect, as the source reports it

  • Attack success rate with residual authority versus a fresh authorisation state. Baseline: Fresh authorisation state. With the change: Residual authority from earlier approvals. Direction: increase. Size: Up to +35.1 percentage points. Sample: 508 AgentDojo attack cases across six LLM families.
  • Attack success in live context-rebinding attacks. Baseline: Without residual-authority replay. With the change: With replay. Direction: increase. Size: +24.9 percentage points on average. Sample: 55 Terminal-Bench cases on three production coding agents.

Agent profile

  • Note on models: Six LLM families on AgentDojo and three production coding agents. The abstract does not name them.

Conflicts of interest

None declared in the abstract. The full text was not checked for a competing-interest statement.

Source

When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents, arXiv, Zhihao Zhang, Chao Wang, Rujia Li, Qingze Wang, Xiaoyan Sun, Jun Dai, 27 September 2026, arXiv:2609.33910. Retrieved ; verification: abstract-only.

Every number in this record was checked against the live arXiv abstract page on 2026-10-08. The full text was not re-checked.

Limitations

  • Preprint, not peer reviewed.
  • Adversarial setting designed by the authors; production-derived authorisation semantics.

For designers

Let an approval expire with the task or context that justified it. A standing "yes" is authority an attacker can reuse later.

Cite this record

Cite the original source for any number, and keep the evidence class and model set with the figure. To point at this record, use "AX evidence register, EV-0015" and this page's address, https://agentexperience.tech/evidence/ev-0015/. The record is also in /evidence.json. The register's licence will be confirmed before its source repository is published.