arxivcs.CRcs.AI2026-06-27
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
Tool-using LLM agents increasingly read untrusted content while holding side-effecting tools such as payments, email, CRM, and infrastructure APIs, yet common framework defaults still conflate tool exposure with authorization. We audit whether LangChain/LangGraph, LlamaIndex, and…