Does an AI Agent's Authorization Actually Bind the Action That Reaches the Executor?

说明与用途

作者研究了AI代理的授权可能与实际执行的操作不绑定的问题，并创建了AgentGuard，以通过执行边界检查确保授权操作与实际执行操作一致，验证动作完整性、边界排他性和权限新鲜度。

问题

When an agent is authorized to perform an action, there is no guarantee that the same action is what eventually gets executed, leading to potential security gaps.

结果

AgentGuard passed 39/39 tests, demonstrating that it can enforce action integrity, boundary exclusivity, and authority freshness. Existing frameworks may or may not provide similar guarantees; the experiment invites community feedback.

工作流

• Identify a consequential tool in the agent system
• Locate where authorization occurs
• Document the exact authorized action (tool, arguments, target, identity, context, policy state, expiry)
• Introduce a material change between authorization and execution (e.g., modify arguments, target, identity, or callable)
• Observe whether the system rejects the modified action

证据

The subsequent independent adversarial retest covered things such as argument changes, target changes, agent identity, runtime identity, capability substitution, replay, expiry, stale policy state, and legitimate execution. It passed 39/39 tests.

来源