Loopjacking: Hijacking Human-in-the-Loop Approval
Loopjacking lets agent approvals authorize a different operation than the human reviewed.
Researchers name Loopjacking for human-in-the-loop failures where approval of operation A is bound to a materially different operation B. One variant misrepresents B at review time; the other substitutes mutable workflow state after a correct review. They reproduced post-approval substitution in seven Agno AgentOS releases through 3.0.9 and in 12 conditional in-memory LangGraph Agent Server compositions through 0.14.0, plus a representation mismatch in OpenClaw 2026.2.23 that 2026.2.24 rejects. OpenAI Agents SDK 0.22.0 and 0.22.2 kept exact serialized per-call binding and rejected mutated actions. Exact approval rendering and use-time comparison, or blocking unauthorized pending-state changes, stopped the tested cases; prevalence was not estimated.