Measuring lingering access risks in tool-using ai agents
CreepScope: Measuring Post-Use Authorization Exposure in Tool-Using Agents
Cryptography and Security
Summary
Sometimes software tools keep permissions longer than needed, creating security risks. The authors study this problem called privilege creep, where access stays usable after it's no longer justified. They create a method called CreepScope that tracks how long permissions remain reachable step-by-step. Their tests show different ways tools manage permissions result in various levels of lingering exposure. This helps understand and measure hidden security risks in automated workflows.
What this means in practice
- •For security engineers: Measure and reduce lingering permission risks in automated software workflows to improve security auditing.
- •For cloud operations teams: Evaluate the effectiveness of permission management policies in cloud tools by analyzing post-use authorization exposure.
Authors
Haoran Yu, Lifei Liu, Danping Zhang, Su Wang, Pin Qian, Yihang Chen, Xiaochong Jiang
Abstract
Authorization checks at individual tool calls do not reveal how long earlier authority remains usable. We study this lifecycle failure as privilege creep: a capability stays reachable after its last justified workflow step. We present CreepScope, a trace-oriented evaluation protocol that samples reachable authority at every step and separates no-remaining-use exposure into stale-after-use and never-required components; Capability-Step Exposure (CSE) counts total stepwise overexposure and Residual Privilege Debt (RPD) the terminal residue, while stale-after-use exposure is the direct privilege-creep measure. A 96-cell deterministic replay over 12 controlled storage, communication, and cloud-operation workflows validates these semantics: Static Task Scope and Monotonic On-Demand retain mean CSEs of 26 and 13, whereas an oracle-controlled Step Lease has zero CSE and zero residual debt by construction. All three persistent regimes share the same stale-after-use exposure of 13, so their CSE differences come from scope and grant timing rather than post-use retention; Full Access alone adds 91.33 never-required capability-steps. A separate 24-episode local case then lets Qwen2 7B choose tools in one simulated mail workflow: the injected stale send executes in all nine persistent-policy episodes and in none of the three Step-Lease episodes, while all 24 required action sequences complete. These results establish a reproducible containment case, not cross-workflow or cross-model effectiveness. Core metrics are reconstructed from raw events, and exact gates reject incomplete or duplicated evaluation grids.