When Approval Becomes Execution: Authorization-Grounded Workflow Attacks on Tool-Using Agents

Summary

This paper studies an authorization-grounded workflow attack on tool-using language-model agents in the OpenClaw Agent Security Attack Competition. The attack walks the agent through a denied document request, a normal approval token request to the local approval service, and supplying that token to the document service via authorized_by, succeeding on three Enterprise OA document targets. In 23 controlled local validation experiments, the original configuration reached the approval-token transition in 9/9 reruns and completed the exact target operation in 8/9 reruns.

Related items

• MediumCVE-2026-111991: WongKinYiu yolov9 code injection via ONNX Metadata HandlerSimilar attack · NVD/CVE Database
• LowWhat are self-replicating ‘AI worms’, and why is Anthropic worried about them?Similar attack · The Guardian Technology
• MediumCVE-2026-112047: OneUptime incorrect authorization in cluster actions by project membersSimilar attack · NVD/CVE Database
• HighCVE-2026-96620: Claude Agent SDK argument injection via resume option enabling command executionSimilar attack · NVD/CVE Database
• HighCVE-2026-59970: Tandoor Recipes SSRF through AI provider URL in AI actionsSimilar attack · NVD/CVE Database