Loopjacking: Hijacking Human-in-the-Loop Approval
Loopjacking lets agent approvals authorize a different operation than the human reviewed.
Researchers name Loopjacking for human-in-the-loop failures where approval of operation A is bound to a materially different operation B. One variant misrepresents B at review time; the other substitutes mutable workflow state after a correct review. They reproduced post-approval substitution in seven Agno AgentOS releases through 3.0.9 and in 12 conditional in-memory LangGraph Agent Server compositions through 0.14.0, plus a representation mismatch in OpenClaw 2026.2.23 that 2026.2.24 rejects. OpenAI Agents SDK 0.22.0 and 0.22.2 kept exact serialized per-call binding and rejected mutated actions. Exact approval rendering and use-time comparison, or blocking unauthorized pending-state changes, stopped the tested cases; prevalence was not estimated.
- Humans can approve operation A while the agent later runs operation B.
- Post-approval substitution was reproduced in Agno AgentOS through version 3.0.9.
- The same class appeared in LangGraph Agent Server compositions through 0.14.0.
- OpenClaw 2026.2.23 mismatched representations; 2026.2.24 rejects that case.
- OpenAI Agents SDK 0.22.0 and 0.22.2 preserved exact per-call binding.
From the original article
1 min read at arxiv.orgHuman approval is often treated as the last security boundary before an agent executes a consequential operation. That boundary is only meaningful if the operation presented for review is the operation later authorized or released. We call failures of this binding Loopjacking: a human approves what they understand as operation A, while the implementation uses that decision for a materially different operation B.
By Adithyan Arun Kumar · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.