When Approval Becomes Execution: Authorization-Grounded Workflow Attacks on Tool-Using Agents
The paper analyzes a workflow-level attack on tool-using LLM agents where the agent follows an apparently legitimate approval flow—requesting an approval token after a document access denial—and then uses that token to access protected enterprise documents. Its useful insight is that the failure is not prompt-injection-style policy override but an authorization-context gap where token possession is over-trusted without binding identity, scope, action, recipient, or purpose, though the evidence is still limited to a controlled benchmark and a small set of OpenClaw document targets.
Abstract
Tool-using language-model agents increasingly rely on local services for document access, approval management, and enterprise workflow execution. This paper studies an authorization-grounded workflow attack in the OpenClaw Agent Security Attack Competition, a controlled benchmark derived from SeClaw-style security task synthesis. Rather than using explicit policy-override instructions, the attack guides the agent through a locally coherent approval workflow: a protected document request is denied, the agent requests a normal approval token from the local approval service, and the returned token is supplied to the document service through authorized_by. Official submission traces show this pattern succeeding on three Enterprise OA document targets. We also conducted 23 controlled local validation experiments in the official OpenClaw execution environment: the original configuration reached the approval-token transition in 9/9 reruns and completed the exact target operation in 8/9 reruns, while single-component variants remained successful on the three document targets. The results provide concrete case evidence of an authorization-context gap: token possession can be treated as sufficient authorization even when requester identity, approver authority, resource scope, action type, destination or recipient, and business purpose are not jointly enforced. We present the attack pattern, controlled trace analysis, and defensive implications for context-bound tokens, service-side policy binding, agent-side authorization checks, and trace-aware benchmark design.