AI-agent approval screens may not bind the action that executes
An unreviewed security study reproduced post-approval argument changes in four of eight measurable runtimes. Trusted action cards sharply reduced benchmark attacks, but no people were tested.
The short version
- What happened
- Researchers audited nine agent runtimes experimentally and one statically; four of eight runtimes with measurable binding allowed arguments to change after approval.
- Who it affects
- People asked to approve agent actions need screens generated from the exact underlying call, with every recipient, amount, path and other consequential argument visible.
- What remains unproven
- This is an unreviewed preprint. It tests open-source designs, simulated or language-model approvers and mock resources; it provides no evidence about how often real people notice mismatches or about compromises of production services.
Keep in mind
This is an unreviewed preprint. It tests open-source designs, simulated or language-model approvers and mock resources; it provides no evidence about how often real people notice mismatches or about compromises of production services.
Source analysis · 2 linked sources. Primary analysed source date: 15 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
A click can approve a description, not the final effect
An approval prompt is not automatically a safety barrier for an AI agent. In a new unreviewed study, researchers found that four of eight agent runtimes whose binding could be measured allowed tool-call arguments to change after approval. The practical risk is simple: a person may click to approve one recipient, payment or file operation while the system later executes different details.
The team tested nine open-source runtimes with isolated probes and reviewed a tenth statically. It also exercised 12 attack patterns against agent-payment, Microsoft governance and Model Context Protocol designs. The authors stress that these are design observations, not evidence that a named production service was breached. Proprietary coding agents were not tested, and one reviewed runtime had no built-in approval mechanism.[1][2]
Showing the actual call changed the benchmark result
The study's proposed defence, Agent Step-Up, places a gateway between the agent and consequential tools. The gateway builds an approval card from a canonical record of every argument, signs a digest with a passkey and executes the stored call rather than accepting resubmitted details from the agent. The researchers tested that design across 27,108 scripted trials and 609 paired AgentDojo cases, alongside weaker approval modes.
When a forged agent narration claimed it was carrying out the user's intended task, attacks succeeded in 54% of the 609 pairs against a narrated card and 3% against the trusted card under an exact-compare simulated approver. Fifteen language models acting as automated approvers caught 30% of 23 attack stimuli from narration alone and 98% when shown the trusted card. That improvement came with a 16% false-denial rate on 11 benign near misses, mostly because placeholder text in the test materials looked suspicious.[1][2]
The distinction that matters
Where an agent approval can fail
The study separates the words a user sees from the action a system signs and finally executes.
Narrated prompt
The agent describes the planned action
A compromised agent can omit or disguise the real target
Bound approval
Trusted code renders and signs every action argument
Any later argument change invalidates the approval
Stored execution
The gateway runs the already-approved call
The agent cannot swap in new details after the click
The missing test is what real people notice
For someone authorising an agent to send email, move money or delete files, the useful question is not merely whether the screen asks for consent. It is whether trusted software generated the screen from the exact action, whether every recipient and argument is visible, and whether changing anything invalidates the approval. Developers also need rate limits: the paper found that approval flooding still defeated modeled approvers in 45% to 60% of trials.
No human participants evaluated the cards. The simulated approvers rely on assumed miss probabilities, the model test used only 34 hand-built stimuli, and active runtimes can change quickly. Some cells came from static review or were derived from the runtime audit, while the language-model and attack-matrix runs used separate recorded commits. The authors built and evaluated their own reference defence, while the paper discloses no visible funding or competing-interest statement. Confidence would rise with independent replication, human usability tests, broader red-teaming and audits of current proprietary tools. Until then, the result supports action-bound approval as a design requirement, not a claim that one implementation has solved agent safety.[1][2]