Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization

Key points

• AI agents now pause for approval before they send money, delete files or email outsiders, and that approval is usually treated as a second factor.1
• We argue it is one only when compromising the agent cannot produce it and when it names exactly what it approves, and we test both conditions.1
• As a reference defense we build ASU (Agent Step-Up), a gateway that renders the approval card from a canonical effect descriptor, has a passkey on the phone of the user sign its digest, and executes only the stored call.1
• With 15 current language models as automated approvers, the trusted card raises the attack catch rate from 0.30 to 0.98, at the cost of refusing 16 percent of harmless near misses, mostly due to a placeholder artifact in our stimuli.1

Sources (1)

• [1]Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 15, 01:11 AM

  We define twelve attacks on the approval path, including decoy recipients, amount cancellation, card padding, label spoofing, enrollment squatting and threshold splitting, and run them against the Agent Payments Protocol (AP2), the Microsoft action-bound approval design and Model Context Protocol (MCP) elicitation.

  AI agents now pause for approval before they send money, delete files or email outsiders, and that approval is usually treated as a second factor.

Extractive summary: sentences quoted from the sources.