LLM代理框架默认未严格校验工具调用权限，存在安全漏洞。
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
- 设计五阶段授权机制ScopeGate，逐项校验调用参数与权限
- 实测显示现有框架48次静态绕过、29次未经授权尝试均被拦截
- 适合关注AI代理安全、需防范恶意工具滥用的开发者
使用工具的LLM代理在持有支付、邮件、CRM等有副作用工具的同时，读取不受信任内容，但常见框架默认将工具暴露等同于授权。我们审计了LangChain/LangGraph、LlamaIndex及Stripe Agent Toolkit是否在每次调用前，基于具体参数值重新验证权限。在固定公开源码版本下，三者虽默认提供能力门控，但均未默认启用按调用值确定性拒绝对接的授权机制。本文提出ScopeGate，一种五阶段PDP/PEP架构：作用域、授权、金额上限、幂等性与默认拒绝。评估显示，相同未经授权的付款调用在LangChain默认分发下仍执行，而ScopeGate予以拒绝；测试控制报告0/48次静态绕过、0/29次未经授权尝试（40轮自适应攻击）、0/10次良性误拒，以及Latam-GPT支付代理10/10的隔离封禁。ASR指未授权操作尝试，隔离非治愈手段，部署层级声明为对已测量模型类的推理，不宣称任何CVE。
原文摘要 · Abstract (English)
Tool-using LLM agents increasingly read untrusted content while holding side-effecting tools such as payments, email, CRM, and infrastructure APIs, yet common framework defaults still conflate tool exposure with authorization. We audit whether LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit re-authorize each model-emitted call, with concrete argument values, before execution. Across pinned public-source commits, all three provide capability gating by default, but none provides a deterministic fail-closed per-call value authorization gate by default. We introduce ScopeGate, a five-stage PDP/PEP for agent tool calls: scope, authorization, money ceiling, idempotency, and default deny. Evaluation shows the identical unauthorized payout call executes under LangChain's default dispatch (with a companion LlamaIndex PoC) but is denied by ScopeGate; the tested control reports 0/48 static bypasses, 0/29 unauthorized attempts (40-iteration adaptive run), 0/10 benign false-denies, and Latam-GPT payment-agent containment at 10/10. ASR denotes attempted unauthorized action, containment is not a cure, deployment-tier claims are inference over measured model classes, and no CVE is asserted.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。