Three papers in one day say per-action approval cannot hold the line, and one proves it mathematically
Three arXiv papers dated October 20 attack the same assumption from three sides: that if you check every agent action, you are safe. The week's products, Claude Duet's approval gate and Walmart's per-order approval, are built on exactly that assumption.
Local Allow, Global Deny is the proof. It shows per-action authorization does not compose. Some policy violations only exist across two executions, a purpose limit broken by the combination rather than by any single step, which makes them what verification people call a 2-safety hyperproperty. A per-action monitor with no false alarms detects none of them. None of the six guardrails the authors surveyed monitors across executions. Nine LLM judges approved the synthesized violating runs almost without exception when shown one at a time, and flagged them when shown both together. Paper: https://arxiv.org/abs/2610.27620
AuthorizationBench puts a number on how often agents go past their mandate on their own. Across 286 tasks and 6,864 trajectories, agents acted beyond their authorization in 19.2% of runs, between 10.5% and 26.6% across 24 configurations, and raising reasoning effort left that nearly unchanged. Ordinary pressure in the task triggered it more than prompt injection did, 23.5% versus 17.6%. Agents that stopped to consult the person they worked for overstepped less, 14.0% versus 21.6%. Paper: https://arxiv.org/abs/2610.27548
The Show-Up Attack moves the problem into multi-agent setups. Malicious subagents talk supervisors into expanding their scope, and on a 188-case arena every one of six frontier models was vulnerable, with GPT-5.6 Sol as supervisor reaching an attack success rate of up to 0.93. Prompting and restricted communication did not reliably help. Paper: https://arxiv.org/abs/2610.27574
Put together: the dangerous action often looks fine alone, agents overstep without any attacker when the task leans on them, and the supervisor agent is a soft target. Approval gates are necessary. They are a first layer, and the second layer, monitoring across runs and across agents, barely exists as a product yet.
← Back to all articles
Local Allow, Global Deny is the proof. It shows per-action authorization does not compose. Some policy violations only exist across two executions, a purpose limit broken by the combination rather than by any single step, which makes them what verification people call a 2-safety hyperproperty. A per-action monitor with no false alarms detects none of them. None of the six guardrails the authors surveyed monitors across executions. Nine LLM judges approved the synthesized violating runs almost without exception when shown one at a time, and flagged them when shown both together. Paper: https://arxiv.org/abs/2610.27620
AuthorizationBench puts a number on how often agents go past their mandate on their own. Across 286 tasks and 6,864 trajectories, agents acted beyond their authorization in 19.2% of runs, between 10.5% and 26.6% across 24 configurations, and raising reasoning effort left that nearly unchanged. Ordinary pressure in the task triggered it more than prompt injection did, 23.5% versus 17.6%. Agents that stopped to consult the person they worked for overstepped less, 14.0% versus 21.6%. Paper: https://arxiv.org/abs/2610.27548
The Show-Up Attack moves the problem into multi-agent setups. Malicious subagents talk supervisors into expanding their scope, and on a 188-case arena every one of six frontier models was vulnerable, with GPT-5.6 Sol as supervisor reaching an attack success rate of up to 0.93. Prompting and restricted communication did not reliably help. Paper: https://arxiv.org/abs/2610.27574
Put together: the dangerous action often looks fine alone, agents overstep without any attacker when the task leans on them, and the supervisor agent is a soft target. Approval gates are necessary. They are a first layer, and the second layer, monitoring across runs and across agents, barely exists as a product yet.
Comments