Add AVE-2026-00081: Lingering Authority (arXiv:2606.22504) - #270
Open
chaksaray wants to merge 1 commit into
Open
Add AVE-2026-00081: Lingering Authority (arXiv:2606.22504)#270chaksaray wants to merge 1 commit into
chaksaray wants to merge 1 commit into
Conversation
A task/subgoal/episode-scoped capability grant (tool permission, credential, access token) outlives the closure event that justified it -- nothing in the agent's runtime ties revocation to that closure, so the agent's later, unrelated turns can reuse a capability that should already be gone. Sourced from Santos-Grueiro, 'Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents' (arXiv:2606.22504), whose PORTICO reference monitor demonstrates the gap empirically: a non-revoking baseline permits 10/10 tested post-closure reuses and executes 6/6 forbidden effects in a deterministic stale-write audit, versus 0/10 and 0/6 under a revoking design. Drafted per issue #217 (Part 2: verify whether the expiration-shaped case is a real, uncovered gap). Part 1 of #217 was also checked -- AVE-2026-00045's real current text already draws the scoping-vs- expiration line sharply, no change needed there. Distinctness, checked by real field comparison, not label similarity: - AVE-2026-00021 / AVE-2026-00063: active bypass of a check at the moment of action. This record bypasses nothing -- the grant is legitimate and simply never re-checked against its own closure. - AVE-2026-00045: scope misuse within a still-valid grant, no elapsed time or external event required. This record is the inverse framing: used within scope, but past when closure should have ended it. - AVE-2026-00050: an undeclared registration smuggled in at session init. This record's capability was legitimately declared and granted. Framework mappings verified against primary sources directly, not corpus precedent: - owasp_mcp: MCP02 (Privilege Escalation via Scope Creep) -- its own detection checklist and remediation #3 (JIT access, revalidation for long-running tasks) name this exact gap. - owasp_asi: ASI03 (Identity and Privilege Abuse) -- its own Common Example #4 is literally 'Time-of-Check to Time-of-Use (TOCTOU) in Agent Workflows', read directly from the primary 2026 PDF. - mitre_atlas / nist_ai_rmf: checked directly (live ATLAS.yaml; NIST AI 100-1 Tables 1-4) and left empty -- no clean fit at this mechanism's granularity, documented in aivss.notes rather than forced. id confirmed via issue #268. Includes: - records/AVE-2026-00081.json - tests/fixtures/AVE-2026-00081_{positive,negative}.md - dist/ave-records-latest.json, .manifest.json (rebuilt from a clean copy of git-tracked records + this one, to avoid pulling in another session's concurrent, unreviewed work sitting untracked in the same working directory) - CHANGELOG.md, README.md (record count, badge, table row) Validated: python3 scripts/validate_records.py (82/82 -- includes the concurrent session's untracked record on disk, harmless to the check), check_fixtures.py, check_vulnerability_taxonomy.py --strict --only, check_framework_sources.py --strict --only, write_verification_basis.py, pytest tests/ -x -q (478 passed).
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements issue #217. Part 1 checked AVE-2026-00045's real current text against the scoping-vs-expiration distinction the issue raised -- already precise, no change needed. Part 2 confirmed the expiration-shaped case (
framework_sources-style gap: a legitimately-issued capability that outlives the episode that justified it) is a real, distinct behavioral class, sourced, and drafted here as AVE-2026-00081.Source: Santos-Grueiro, "Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents" (arXiv:2606.22504, cs.CR, 2026-06-21). Coins the term and proposes PORTICO, a reference monitor with an explicit request-grant-invoke capability lifecycle. Empirically: a non-revoking baseline permits 10/10 tested post-closure capability reuses and executes 6/6 forbidden effects (file writes, git mutation, network egress) in a deterministic stale-write audit, versus 0/10 and 0/6 under the revoking design.
Severity: MEDIUM, AIVSS 6.1.
Distinctness (real field comparison, not label similarity)
Framework mappings (verified against primary sources)
owasp_mcp: MCP02 (Privilege Escalation via Scope Creep) -- read the full primary-source text (github.com/OWASP/www-project-mcp-top-10, commit165fe0f). Its detection checklist names 'no enforced expiration for scopes or tokens' verbatim; remediation feat: add 5 new ave records #3 is JIT access with revalidation for long-running tasks -- the same gap.owasp_asi: ASI03 (Identity and Privilege Abuse) -- read the actual 2026 PDF directly (genai.owasp.org). Common Example feat: add new ave rule records #4 is literally "Time-of-Check to Time-of-Use (TOCTOU) in Agent Workflows," and Example Attack Scenario doc: add new ave records #5 ("Workflow Authorization Drift") describes this exact mechanism.mitre_atlas: checked directly against the live 170+ techniqueATLAS.yaml-- no clean fit (the only hit, stolen-token abuse, is a different mechanism). Left empty, documented inaivss.notes.nist_ai_rmf: checked the actual NIST AI 100-1 text (Tables 1-4) directly -- MANAGE-2.4 and GOVERN-1.7 are the closest but operate at whole-system granularity, not per-capability revocation. Left empty, documented inaivss.notes.A note on this PR's scope
While drafting this I found a second, concurrent Claude Code session (
ave-a5) with its own unrelated, uncommitted work sitting in the same working directory (AVE-2026-00082, a local skill-name-collision record from issue #150). This PR deliberately excludes it --dist/ave-records-latest.jsonwas rebuilt from a clean copy of git-tracked records plus only this one new file, specifically so that session's not-yet-reviewed work doesn't get published as a side effect of this PR. It's untouched on disk for that session to commit and PR on its own.Checklist
python3 scripts/validate_records.py-- 82/82 valid (includes the concurrent session's untracked record on disk; harmless to the check, not part of this PR's diff)python3 scripts/check_fixtures.pypython3 scripts/check_vulnerability_taxonomy.py --strict --only AVE-2026-00081python3 scripts/check_framework_sources.py --strict --only AVE-2026-00081python3 scripts/write_verification_basis.pypytest tests/ -x -q-- 478 passednode scripts/build-records.js(isolated input dir, not hand-edited)Closes #268.
Part of #217 (Part 1 confirmed no change needed to AVE-2026-00045; leaving #217 open only if there's further follow-up expected, otherwise closing alongside this).