智能體高風險審批暴露綁定漏洞

Computer Science > Cryptography and Security arXiv:2610.21063 (cs) [Submitted on 15 Oct 2026] Title:Approve What, Exactly?

Effect Binding and Trusted Rendering for Agent Step-Up Authorization Authors:Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill View a PDF of the paper titled Approve What, Exactly?

Effect Binding and Trusted Rendering for Agent Step-Up Authorization, by Sai Varun Kodathala and 2 other authors View PDF HTML (experimental) Abstract:AI agents now pause for approval before they send money, delete files or email outsiders, and that approval is usually treated as a second factor.

We argue it is one only when compromising the agent cannot produce it and when it names exactly what it approves, and we test both conditions.

We define twelve attacks on the approval path, including decoy recipients, amount cancellation, card padding, label spoofing, enrollment squatting and threshold splitting, and run them against the Agent Payments Protocol (AP2), the Microsoft action-bound approval design and Model Context Protocol (MCP) elicitation.

An audit of ten agent runtimes finds no third-party verifiable approval record, no flood limits where measurable, and post-approval argument changes in four of eight runtimes with measurable binding.

As a reference defense we build ASU (Agent Step-Up), a gateway that renders the approval card from a canonical effect descriptor, has a passkey on the phone of the user sign its digest, and executes only the stored call.

Tamarin proves its binding, single-use and key-level non-repudiation properties under three stated hypotheses (53 lemmas).

Across 27,108 scripted trials and 609 AgentDojo attack pairs, ASU stops substitution, replay and grant stretching, and the trusted card cuts forged-narration attack success from 0.54 to 0.03.With 15 current language models as automated approvers, the trusted card raises the attack catch rate from 0.

30 to 0.98, at the cost of refusing 16 percent of harmless near misses, mostly due to a placeholder artifact in our stimuli.A second device adds nothing measurable over a trusted on-host confirmation in these experiments, flooding still succeeds 0.45 to 0.

60 of the time against a modeled approver, and approval cannot stop effects that policy already allows.Code, data and proofs: this https URL Comments: 36 pages, 13 figures, 13 tables.Code and data at this https URL Subjects: Cryptography and Security (cs.CR); Artificial Intelligence (cs.

AI) Cite as: arXiv:2610.21063 [cs.CR] (or arXiv:2610.21063v1 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2610.

21063 Focus to learn more arXiv-issued DOI via DataCite (pending registration) Submission history From: Sai Varun Kodathala [view email] [v1] Thu, 15 Oct 2026 01:11:23 UTC (976 KB) Full-text links: Access Paper: View a PDF of the paper titled Approve What, Exactly?

Effect Binding and Trusted Rendering for Agent Step-Up Authorization, by Sai Varun Kodathala and 2 other authorsView PDFHTML (experimental)TeX Source view license Additional Features Audio Summary Current browse context: cs.CR < prev | next > new | recent | 2026-10 Change to browse by: cs cs.

AI References & Citations NASA ADSGoogle Scholar Semantic Scholar export BibTeX citation Loading...BibTeX formatted citation × loading...Data provided by: Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?

) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv (What is alphaXiv?

) Links to Code Toggle CatalyzeX Code Finder for Papers (What is CatalyzeX?) DagsHub Toggle DagsHub (What is DagsHub?) GotitPub Toggle Gotit.pub (What is GotitPub?) Huggingface Toggle Hugging Face (What is Huggingface?) ScienceCast Toggle ScienceCast (What is ScienceCast?

) Demos Demos Replicate Toggle Replicate (What is Replicate?) Spaces Toggle Hugging Face Spaces (What is Spaces?) Spaces Toggle TXYZ.AI (What is TXYZ.AI?) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower (What are Influence Flowers?

) Core recommender toggle CORE Recommender (What is CORE?) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy.arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?Learn more about arXivLabs.Which authors of this paper are endorsers?| Disable MathJax (What is MathJax?)