Compromise Is Not Consequence: Evaluating Task-Scoped Authorization in LLM Agents with Paired Replay

What it is

A measurement methodology paper (arXiv:2610.05840v1) that isolates "did the model get compromised" from "did the compromised action execute" in LLM agent security evaluations, using a technique called paired replay: one live model decision is frozen and resubmitted unchanged to four authorization backends (broad bearer token, scoped JWT, sender-constrained DPoP, OPA policy evaluator).

How it works

The agent samples a single post-exposure tool request q = (action, resource, arguments) after seeing untrusted/injected content. That exact request is replayed against all four authorization conditions from equivalent reset pre-state, so the comparison isolates policy behavior rather than model stochasticity. Two formal events are tracked separately: compromise C (model selected an out-of-scope action) and harmful execution H (that action actually ran). A policy can change H while C stays constant — the paper's central claim is that scoping contains consequence, not compromise itself.

Preconditions / Affected

Applies to tool-using LLM agents where authorization is enforced at the service/orchestration layer, not inferred from model intent. Tested conditions: broad bearer tokens (signed, task-bound, but no action/resource restriction) vs. scoped JWT, DPoP (asymmetric proof-of-possession with jti/htm/htu/iat/ath/cnf.jkt binding), and OPA external policy evaluation — all three scoped modes require action/resource claims to be explicitly declared per task.

What to do

Concrete numbers an engineer can cite when arguing for scoped credentials over broad bearer tokens:

• Broad-bearer post-exposure harmful execution rates by model: Llama 3.1 8B 37.8% [30.5–45.9%], Gemma 3 4B 35.5%, Llama 3.2 3B 36.7%, Mistral 7B 10.4%, Qwen3 4B 8.9% (95% CI, cluster bootstrap over 1,280 attacked trajectories/model).
• All three scoped conditions (scoped JWT, DPoP, OPA) recorded 0/1,280 harmful executions per model — zero-width intervals, i.e., complete containment in this corpus.
• Out-of-scope selection counts were far higher than executions (e.g., Gemma 636 out-of-scope selections vs. 454 broad-bearer executions), showing scoping doesn't need to catch every bad selection, only block its execution.
• AgentDojo cross-check: 11/24 injected attacks succeeded under broad policy vs. 0/24 under scoping, with task utility 5/24 and 6/24 respectively.
• DPoP implementation passed 8/8 adversarial checks (stolen token without key, proof replay, wrong method/URI/hash); OPA passed 21/21 allow/deny checks.

Actionable takeaway: enforce action/resource scoping in the token itself (JWT claims or external policy) rather than relying on broad bearer auth plus downstream model-side defenses — the containment effect held across all five tested local models.

Caveats

The paper explicitly states this measures safe continuation (authorized next action or no-tool decision), not verified final-answer task correctness — a scoped denial that stalls the agent counts as "safe," not "task completed successfully." It also found no estimation advantage from paired replay over fresh sampling when scoped outcomes are constant zero, and stresses the result shows containment of tested cross-action/cross-resource consequences under researcher-defined task authority, not general prevention of prompt injection or proof that production systems using the same protocol names behave identically.