When Consent Outlives Context: Residual Authority Replay in Long-Lived Agents
It is demonstrated that residual-authority replay arises in practice and substantially increases the success of prompt-injection and context-rebinding attacks, exposing a fundamental mismatch between persistent authorization and the contextual nature of user consent in long-lived LLM agents.