Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-10-28

HighPrimary

Role Grounding Research Steered Agents Toward Attacker Tools and Sensitive Tool Arguments

Controlled Role Grounding Attack research reports misattributed preferences steering agent tool selection and sensitive arguments, not verified external data delivery.

Memory-enabled multi-agent research systemGovernance bypassControlled research on role-to-principal misattribution in persistent agent memorySimulated social platform and downstream tool-call requests using five memory systems and six model backends

What happened

Experimental agents selected attacker-controlled tools for downstream requests and filled their parameters with target sensitive values stored in memory.

Why it matters

No production compromise is established. The demonstrated effects are tool-selection manipulation and sensitive values in selected tool parameters on a simulated platform; the privacy metric does not independently verify external data delivery.

Missing authorization check

Authentic principal-bound authority for tool choice and release of sensitive values, independent of remembered preferences and third-party social content.

Would PP block it?

A deployment could require a grant bound to the principal, exact tool, arguments and destination before executing a selected call. This would constrain dispatch only where the boundary is integrated and enforced. The paper does not test PP, and no prevention rate is claimed.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-10-28

    The Role Grounding Attack preprint reports controlled memory-attribution, tool-selection and sensitive-argument experiments.

Technical breakdown

  • Publisher-Preference Decoupling and Nested Conversation Construction make a publisher's own-user preference appear relevant to the victim's user.
  • Memory formation and retrieval can preserve the publisher while misbinding the embedded preference to the victim principal.
  • Downstream experiments use simulated tool requests and candidate tools across five functional groups.
  • The privacy metric requires selection of the attacker tool plus the target sensitive value in that tool's parameters; it is not a network-delivery measurement.
  • The authors evaluate five memory systems and six model backends, with the privacy field breakdown covering a subset of models.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Tool dispatch and sensitive-data release after model selection but before any external effect
Still needs
PP does not correct stored attribution, prevent all sensitive values entering model context, or prove the truth of remembered preferences. Research metrics do not establish delivery to a real attacker endpoint.
Receipt required for
Executing attacker-selected tools or releasing sensitive memory-derived values to a destination

An independently enforced tool and data-release gate could check actual user authority before dispatch, but would not repair the memory-attribution error or necessarily prevent model-side parameter generation.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop