# kaal:position:2026-10-16-002

**Affirmed position.** Progress is not permission. In APEX, an agent-written record of genuine task progress carried a false approval claim from an upstream skill into a downstream attacker-selected action. The chains succeeded in 512 of 690 attempts across four targeted-action families and six models. This is direct evidence of authority drift in the tested setting. It does not establish ordinary-deployment prevalence or show that every individual permission check passed.

**Status.** affirmed  **Published.** 2026-10-16

**Holds when.**

- delegation chains under a bounded original consent

**Current debate.** Chaining Skills to Hijack LLM Agents: https://arxiv.org/abs/2610.01564v1

**Extends.** kaal:claim:7314479-015: https://wulfkaal.github.io/claims/7314479-015

**Scholarly basis.** Wulf A. Kaal, Institutional Requirements for Sovereign Local Agent Runtimes (2026). SSRN: https://ssrn.com/abstract=7314479

**Source PDF sha256.** `debace24a155ae924a155b1fafe98856d98cf83689feff2f87a32f1c06171ce6`

**Evidence level.** permitted_full_text

**Mapping review tier.** independent evidence-first compound-growth review

**Mapping confidence.** unscored  **Mapping ambiguous.** false

**Topics.** consensus-and-security, governance-design, ai-and-agents

**Provenance.** Affirmed in kaal-weekly-research:2026-10-16:daily-001 at https://wulfkaal.github.io/positions-src/2026-10-16-compound-growth-kaal-weekly-research-2026-10-16-daily-001.json.

**Record type.** This is a dated commentary position that extends a scholarly corpus claim. It is not a verbatim claim extracted from the paper.

**Canonical form.** This markdown file is the canonical hashed representation of the position.