LATIDIA · Ciberseguridad

El compromiso no es consecuencia: evaluación de la autorización del alcance de la tarea en agentes de LLM con repetición emparejada

arXiv:2610.05840v1 Announce Type: new Abstract: Un modelo que utiliza herramientas puede seguir una instrucción maliciosa incluso cuando sus credenciales son válidas. Estudiamos si la autorización del ámbito de la tarea contiene la ejecución de la herramienta resultante.

La noticia

arXiv:2610.05840v1 Announce Type: new Abstract: A tool-using model can follow a malicious instruction even when its credentials are valid. We study whether task-scoped authorization contains the resulting tool execution. Our paired-replay testbed samples a model request once and submits the same action, resource, and arguments to broad bearer, scoped JWT, sender-constrained, and Open Policy Agent conditions. The frozen main experiment uses 128 scenarios across four tool domains and five local model configurations. Among valid attacked post-exposure decisions, broad-bearer harmful execution ranges from 8.9% to 37.8% across models; all three scoped conditions record zero. The policy changes execution, not the frozen model decision. These results support containment of the tested cross-action