Whose Credential Is It? How Owner Attribution in Agent MemoryShapes Cross-User Account Misuse
Shared long-term memory lets an LLM agent serving one user inadvertently retrieve another user's credentials, but it is unclear when such exposure leads to actual harm. We introduce a three-stage audit that separates three events: a foreign credential reaches the prompt (exposure), the agent acts with it (behavior), and the other user's account changes (state). In AppWorld, a store that mixes 763 past logins from all users retrieves another user's credential for 84.7 percent of required apps, yet agents rarely act on it. Misuse appears in a stress test where memory lacks the user's own credential and presents a single foreign one as the user's record: seven agents then use it in 80 to 94 ...
| Authors | Hau-Sing So, Daixian Liu, Carl Hou et al. |
|---|---|
| Primary category | cs.AI |
| Published | 19 October 2026 |
| Last updated at source | 19 October 2026 |
Popularity, last 3 days
0 now. Counts as reported by the source, snapshotted daily by Silytics.
Silytics shows public metadata from arXiv and links to the original. Information may be incomplete or out of date. Last refreshed 22 October 2026. Licenses and terms of the original apply to the work itself. Not financial, legal or professional advice.