Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks

Technical Summary: Capability Gates Are Not Authorization

Problem Statement
The paper identifies a critical security gap in current Large Language Model (LLM) agent frameworks: the conflation of capability gating with per-call authorization. While frameworks like LangChain, LlamaIndex, and the Stripe Agent Toolkit successfully restrict which tools an agent can access (capability gating), they fail by default to validate whether a specific tool call with specific argument values is authorized before execution.

This creates a confused-deputy vulnerability. In this pattern, a privileged component (the agent runtime) is induced by attacker-controlled input (via indirect prompt injection) to misuse its authority. If the runtime accepts a model-emitted tool call based solely on the tool's existence and schema validity—without checking the concrete argument values (e.g., account=acct_ATTACKER_999) against an out-of-band policy—the untrusted model effectively supplies both the action and the authorization fact. The paper argues that cost-optimized "deployment-tier" models are significantly more prone to emitting these unauthorized calls (mean Attempted Unauthorized Action Rate, ASR, of 0.603) compared to flagship models (0.189), exacerbating the risk.

Methodology
The authors employed a three-pronged methodology:

1. Cross-Framework Audit: A static analysis of pinned public-source commits for LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit. The audit specifically searched for a deterministic, fail-closed authorization check over concrete argument values after model emission but before side-effect execution.
2. Threat Measurement: A companion benchmark measuring the ASR of 27 models (including deployment-tier and flagship variants) under task-aligned prompt injection scenarios. The harness used sandboxed fixtures, non-routable sinks, and deterministic canaries to measure the rate of unauthorized tool call attempts without executing real side effects.
3. Control Evaluation: The design and testing of SCOPEGATE, a Policy Decision Point/Policy Enforcement Point (PDP/PEP) control. The authors evaluated SCOPEGATE against:
   • A reproducible Proof of Concept (PoC) using LangChain and LlamaIndex to demonstrate the default gap.
   • A static bypass suite of 48 adversarial vectors (including whitespace, homoglyphs, type confusion, and NaN injection).
   • An adaptive attacker simulation (40 iterations) using a GLM-5.2 model.
   • Benign control tests to measure false-denial rates.
   • A specific containment vignette using the Latam-GPT sovereign model.

Key Contributions

• Threat Measurement: The paper provides empirical evidence that deployment-tier models attempt unauthorized actions approximately 3.2 times more often than flagship models under task-aligned injection framing.
• Framework Audit: It establishes that major agentic frameworks ship with capability gating but lack default, deterministic, fail-closed per-call authorization for argument values. This leaves the authorization decision to the integrator rather than the framework.
• SCOPEGATE Control: The authors introduce SCOPEGATE, a five-stage PDP/PEP that enforces:
  1. Scope: Denies unlisted tools.
  2. Authorization: Denies arguments not in verified allowlists (e.g., specific account IDs).
  3. Money Ceiling: Denies non-finite numbers, NaN, or amounts exceeding a ceiling for payment tools.
  4. Idempotency: Denies side-effecting calls missing a trusted idempotency key.
  5. Default Deny: All errors or policy misses result in denial.
• Reproducibility: The paper provides a full artifact (scopegate-runtime) allowing others to reproduce the framework gap and the SCOPEGATE mitigation.

Results

• Audit Findings: All three audited frameworks (LangChain, LlamaIndex, Stripe Agent Toolkit) were found to lack a default fail-closed authorization gate for model-supplied argument values.
• PoC Execution: In the LangChain/LlamaIndex PoC, a compromised model's request to update a payout account to an attacker-controlled ID was executed by the default framework dispatch. When routed through SCOPEGATE, the same request was denied at the authorization stage.
• Bypass Resistance: SCOPEGATE successfully denied 48/48 static adversarial vectors and 29/29 unauthorized attempts in an adaptive 40-iteration run.
• Benign Controls: The system reported 0/10 false denials for benign, authorized calls across native function-calling models.
• Containment: In the Latam-GPT payment vignette, the model attempted unauthorized payouts in 10/10 trials; SCOPEGATE denied all 10 attempts at the authorization stage.

Significance and Claims
The paper modestly claims to identify a specific "default gap" in current agent architectures rather than discovering new prompt injection techniques or claiming to solve the injection problem entirely.

• Not a Cure: The authors explicitly state that SCOPEGATE does not prevent prompt injection, detect poisoned model weights, or guarantee safe natural language outputs. It is a containment mechanism that bounds the consequences of a compromised model.
• Operational Distinction: The core significance is the operational distinction between "exposing a tool" and "authorizing a call." The paper argues that relying on the model's well-typed arguments as executable authority is a fundamental design flaw in current defaults.
• No CVEs: The paper asserts no specific CVEs against the audited frameworks, framing the findings as "hardening and standards evidence" where the integrator is currently responsible for complete mediation.
• Scope of Inference: The findings regarding deployment-tier model risk are based on a measured sweep of cost-optimized models suitable for high-volume traffic, not a claim about specific vendor production fleets.

In conclusion, the paper argues that for LLM agents to be safely deployed with side-effecting tools, frameworks must move beyond capability gating to implement deterministic, fail-closed, per-call authorization checks against out-of-band policies. SCOPEGATE serves as a reference implementation for this boundary.