Authorization Gap in Multi-Agent LLM Delegation Frameworks

Technical Analysis

The paper identifies that most agentic runtimes grant broad bearer-style credentials to agents and rely on the LLM itself to gate authorization decisions, rather than enforcing authorization at a trusted boundary outside the model. This creates four exploitable adversary classes: confused deputy (an agent using its legitimate credentials on behalf of an untrusted request), token theft/replay, prompt-injection-driven privilege escalation, and compromised sub-agents inheriting or exceeding their delegator's authority. Because sub-agents and tool calls are spawned dynamically and credentials are broadly scoped, a single successful prompt injection into any agent in the chain can cascade into full access to all 8,100 reachable actions in their test environment, rather than being confined to the ~1.5 actions actually delegated. The entry point is any untrusted input reaching the LLM's context (tool output, user input, inter-agent message); the attacker's gain is lateral privilege expansion across the agent graph, crossing trust boundaries between agents, tools, and services. The authors' proposed fix -- an external authorization broker enforcing capability-scoped, non-forgeable tokens outside the LLM's control -- demonstrates that policy enforcement must be moved out-of-band from the model to close this gap.

Affected Systems

LangGraph, CrewAI, AutoGen; protocols: MCP

Detection Signatures

• Look for agent architectures where a single bearer token or API key is shared across all sub-agents and tool calls
• Audit logs for tool/action invocations far outside an agent's originally delegated task scope
• Monitor for sub-agents receiving or replaying parent-agent credentials without scope narrowing
• Flag authorization checks implemented solely via LLM prompt logic (e.g., system-prompt instructions like 'only call tool X') rather than enforced by an external policy engine
• Alert on anomalous spikes in distinct tool/action types invoked per agent session relative to task baseline

Remediation Steps

1. 1

   Enforce out-of-band authorization

   Move authorization decisions out of the LLM's control into an external broker or policy engine that issues scoped, non-forgeable, short-lived capability tokens per delegated task.

2. 2

   Eliminate broad bearer credentials

   Replace shared broad-access API keys/tokens with per-agent, per-task minimally-scoped credentials that cannot be replayed across contexts.

3. 3

   Confine sub-agent capability at spawn time

   When an agent spawns a sub-agent, explicitly derive and restrict its capability set to only the actions needed for its specific delegated task, never inheriting the parent's full permission set.

4. 4

   Adopt zero-trust assumption for agent runtimes

   Design and test systems under the assumption that any agent may be fully prompt-injected; verify that even a compromised agent cannot exceed its explicitly delegated authority.

5. 5

   Adversarially test authorization boundaries

   Run red-team style token forgery, replay, and confused-deputy tests against agent orchestration frameworks (LangGraph, CrewAI, AutoGen, MCP servers) before production deployment.