Loopjacking: Hijacking Human-in-the-Loop Approval
Loopjacking lets agent approvals authorize a different operation than the human reviewed.
Researchers name Loopjacking for human-in-the-loop failures where approval of operation A is bound to a materially different operation B. One variant misrepresents B at review time; the other substitutes mutable workflow state after a correct review. They reproduced post-approval substitution in seven Agno AgentOS releases through 3.0.9 and in 12 conditional in-memory LangGraph Agent Server compositions through 0.14.0, plus a representation mismatch in OpenClaw 2026.2.23 that 2026.2.24 rejects. OpenAI Agents SDK 0.22.0 and 0.22.2 kept exact serialized per-call binding and rejected mutated actions. Exact approval rendering and use-time comparison, or blocking unauthorized pending-state changes, stopped the tested cases; prevalence was not estimated.
- Humans can approve operation A while the agent later runs operation B.
- Post-approval substitution was reproduced in Agno AgentOS through version 3.0.9.
- The same class appeared in LangGraph Agent Server compositions through 0.14.0.
- OpenClaw 2026.2.23 mismatched representations; 2026.2.24 rejects that case.
- OpenAI Agents SDK 0.22.0 and 0.22.2 preserved exact per-call binding.
Full article220 words · extracted from arxiv.org · click to collapse
Human approval is often treated as the last security boundary before an agent executes a consequential operation. That boundary is only meaningful if the operation presented for review is the operation later authorized or released. We call failures of this binding Loopjacking: a human approves what they understand as operation A, while the implementation uses that decision for a materially different operation B. We distinguish two variants. In a representation-based attack, B is already encoded but omitted or misrepresented at approval time; in a post-approval state-substitution attack, the human sees the correct A and mutable workflow state later replaces it with B. We evaluate a purposive set of released agent products. We reproduce post-approval substitution in seven tested Agno AgentOS releases ending at 3.0.9 and in 12 tested versions of a conditional in-memory LangGraph Agent Server composition ending at 0.14.0. We reproduce representation mismatch in OpenClaw 2026.2.23 and its rejection in 2026.2.24. OpenAI Agents SDK 0.22.0 and 0.22.2 provide a negative control: serialized continuation preserves exact per-call binding and rejects mutated B. These results do not estimate ecosystem prevalence. They show that complete canonical approval rendering and exact use-time comparison, or preventing unauthorized pending-state mutation, block the tested attacks while preserving legitimate execution. We separate this contribution from established work on misleading dialogs, session smuggling, action binding, and authorization continuity.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21081