TLDR
长期运行的 LLM Agent 依赖持久内存来跨交互保持状态，包括权限、限制与撤销。当内存错误地呈现这种不断演变的授权状态时，Agent 自身的记录可能授予底层历史从未允许的权限，导致在没有任何外部攻击的情况下出现行为失准。我们将这种失败称为内生授权洗钱（endogenous authorization laundering），即写入内存中的虚假权限在来源被洗去后引发越权操作。我们进一步提出 EAL-Bench，用于衡量持久内存Long-running LLM agents rely on persistent memory to carry state across interactions, including permissions, restrictions, and revocations. When memory misrepresents this evolving authorization state, the agent's own records can grant authority that the underlying history never permitted, resulting in misaligned behavior without any external attacks. We term this failure endogenous authorization laundering, where spurious permissions written into memory lead to unauthorized actions as their provenance is washed away. We then introduce EAL-Bench, which measures how accurately persistent memory