CapLease: Durable Authorization State for Replay-Resistant LLM Agent Actions

A recent paper on arXiv (2608.01710v1) presents CapLease, a layer for authorization consumption aimed at mitigating semantic replay in large language model (LLM) agents that utilize tools. The research highlights a vulnerability where agents, upon replanning, retrying, delegating, or recovering from failures, might execute a single user authorization multiple times with new token identifiers, despite each token being designed for one-time use. This phenomenon, referred to as 'semantic replay,' surpasses the execution budget of a token-independent authorization instance. The authors contend that merely using identifier-local token consumption is inadequate unless the issuer maintains a monotonic durable state regarding the authorized action, confirmation event, and execution budget. CapLease introduces defenses at both proposal and authority levels, ties authenticated user confirmations to canonical actions, and enforces transactional Issue-Prepare-Commit transitions. This work falls under cs.CR and cs.AI, with significant implications for the security and reliability of LLM agent systems in operational settings.