Long‑running LLM agents rely on persistent memory to keep state across interactions, including permissions, restrictions and revocations. When the memory misrepresents the evolving authorization state, the agent’s own records can grant authority that never existed, causing misaligned behavior without external attacks. We call this phenomenon endogenous authorization laundering: spurious permissions written into memory lose their provenance and lead to unauthorized actions. To study it we introduce EAL‑Bench, which measures how faithfully persistent memory preserves changing authorization state and whether errors propagate to downstream unauthorized actions. We evaluate five LLMs as memory writers and two as executors across procurement, cybersecurity and finance scenarios. Under incremental memory updates, writers generate false authority for up to 50.2% of unauthorized requests; once false authority appears, executors act on it in 98.6% of trials. We test two safeguards: requiring stored permissions to be backed by valid source events, and tracking permission changes through bounded event sourcing. Both substantially reduce laundering but also reject more legitimate actions, revealing a safety‑utility tradeoff. Persistent memory is therefore not merely a performance component but a core part of an LLM agent’s effective authorization policy.
Review