An agent’s own memory can grant it permissions its history never gave

What happened

A preprint names "endogenous authorization laundering": when an agent’s persistent memory records an authorisation state that the real interaction history never established, the memory itself becomes the source of permission. No attacker is required. The agent grants itself authority because its notes say it has it.

On the authors’ EAL-Bench, memory writers granted false authority to as much as 50.2 per cent of unauthorised requests, and executors then acted on 98.6 per cent of those false permissions. Tested across five models as memory writers and two as executors. The finding sits alongside the prompt-injection work on this board but is a different shape: the failure is in what the system remembers about permission, not in what an attacker manages to say to it. Unreviewed preprint.