Research · curated 13 Jul 2026
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
First reported · updated · 2 reports arxiv.org
Coverage timeline
Why it matters
Confused-deputy failures in popular LLM agent frameworks mean an agent that reads untrusted content while holding payment, email, or infrastructure tools can be induced to execute unauthorized side-effecting calls, so defenders must add per-call value authorization rather than rely on tool exposure gating.
A security research paper, 'Capability Gates Are Not Authorization,' audits LangChain/LangGraph, LlamaIndex, and the Stripe Agent Toolkit and finds that all three provide capability gating by default but none enforce a deterministic fail-closed per-call value authorization gate, enabling classic confused-deputy abuse where an attacker-influenced model emits an unauthorized side-effecting call (e.g., a payout). The authors introduce SCOPEGATE, a five-stage PDP/PEP control (scope, authorization, money ceiling, idempotency, default deny), and report an identical unauthorized payout executing under LangChain's default dispatch but denied by SCOPEGATE, with an available artifact (github.com/raceksd-source/scopegate-runtime).