Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions

2026-08-03

AI Summary

This work identifies a critical vulnerability in large language model (LLM) agents: even when using single-use tokens, repeated execution of the same user authorization during replanning, retries, or crash recovery can lead to semantic replay attacks and budget overruns. The study demonstrates for the first time that token-based mechanisms alone are insufficient to prevent such attacks and argues that maintaining a persistent, monotonic state of authorized actions, confirmation events, and remaining budgets is essential for effective replay protection. To address this, the authors propose CapLease, a mechanism that enforces end-to-end idempotency through a transactional Issue-Prepare-Commit protocol, binding user confirmations to actions, and employing idempotent external receivers. Experiments across diverse LLM agent scenarios show that CapLease effectively prevents duplicate authorizations and their unintended side effects, underscoring the necessity and superiority of persistent authorization state over transient token-based approaches.

Abstract

Tool-using large language model agents frequently replan, retry failed operations, delegate tasks, and resume after crashes. These behaviors can cause one user authorization to be requested and executed multiple times under freshly issued token identifiers, even when each individual token is single-use. We call this failure semantic replay: exceeding the execution budget of a token-independent authorization instance rather than merely reusing an old token identifier. We show that identifier-local token consumption cannot prevent fresh reissuance unless the issuer retains monotonic durable state over the authorized action, confirmation event, and remaining execution budget. We introduce CapLease, an authorization-consumption layer that follows proposal- and authority-level defenses, binds an authenticated user confirmation to a canonical action, and enforces transactional Issue-Prepare-Commit transitions. Across LLM-agent replanning, retry, delegation, concurrency, confirmation-replay, and crash-recovery scenarios, identifier-local tokens permit fresh semantic reissuance, whereas CapLease and an equally stateful Server Ledger prevent duplicate admission and, with an idempotent sink, duplicate external effects. Our results identify durable authorization state, rather than token representation alone, as the systems requirement for replay-resistant agent execution.

Problem

• semantic replay
• durable authorization state
• LLM agent actions
• replay resistance
• execution budget

Innovation

• semantic replay
• durable authorization state
• CapLease
• LLM agents
• idempotent execution