Security researchers have demonstrated that human-in-the-loop (HITL) approval — the industry’s most-deployed safeguard against AI agent overreach — can be bypassed without triggering sandboxes, without touching the model, and without leaving a trace in agent logs. The attack class, called Loopjacking, was detailed in a paper published September 17 (arxiv 2609.21081) and reproduced against two frameworks your production agents are likely running: LangGraph Agent Server and Agno AgentOS. The mechanism is straightforward: your agent shows a human one operation, receives approval, then executes a different one. That gap between what was approved and what runs is the vulnerability.
Two Ways to Break Approval #
The paper identifies two distinct attack variants, each with a different root cause.
Representation mismatch is the quieter form. Operation B is already encoded in the agent’s state before the approval prompt appears. The human sees operation A — or an incomplete, misleading description — approves it, and the system executes B. No state change happens after approval; the deception was baked in from the start. Detection is harder because the approval log looks clean.
Post-approval state substitution is more aggressive. The human sees the correct operation A, approves it, and the approval is recorded. Then mutable workflow state is swapped for B before execution is dispatched. The approval event is real and legitimate; the substitution happens in the gap between authorization and execution. This is the variant reproduced in LangGraph and Agno.
The CSRF analogy holds: you think you authorized one thing; something else ran on your behalf. Except with AI agents, “something else” might mean deploying to production, sending emails, or modifying a database.
Which Frameworks Are Affected #
LangGraph Agent Server (LangChain): post-approval substitution reproduced across 12 tested versions, up through v0.14.0. The root cause is mutable pending-state that can be modified after a human approval event is recorded but before the action is dispatched to the executor.
Agno AgentOS: reproduced in seven releases from v2.5.6 through v3.0.9. The Agno team has merged nine authorization guard fixes in PR #10270 — check whether your deployment has pulled that update.
OpenAI Agents SDK (v0.22.0 and v0.22.2) was used as the positive control and found resistant. The SDK uses serialized continuation: the exact per-call action is serialized into run state along with approval metadata, and any mutation of the pending action after serialization is rejected before dispatch. This is the reference architecture to study if you’re building or hardening an approval pipeline. The OpenAI Agents SDK human-in-the-loop documentation covers the implementation details.
What to Do Right Now #
If you are running a production AI agent with HITL controls, this is the checklist:
- LangGraph Agent Server : if you’re on v0.14.0 or earlier, review release notes for the post-approval substitution fix and upgrade. Check whether your composition uses in-memory conditional state (the vulnerable pattern) or immutable serialized state.
- Agno AgentOS : pull PR #10270 or upgrade to a release that includes it. Verify the nine authorization guards are active in your deployment.
- Any framework : audit the path between “approval recorded” and “action dispatched.” The action object shown to the human must be the same object passed to execution — no mutable state writable by any process after approval is given.
- Defense in depth : hash the canonical serialized action before presenting it for approval; verify the hash before executing. This is deterministic pre-action authorization — the paper cites it as the most reliable mitigation regardless of framework.
The reproduction archive on GitHub includes harnesses that let you test your own approval pipeline against both attack variants. Running it against your stack before your adversaries do is worth the hour.
The Pattern #
September 2026 has now delivered three distinct AI agent attack classes in under four weeks. GitSpawn (September 1) weaponizes the repository before the agent even starts. Plugin4Shell (September 18) injects via the plugin update pipeline. Loopjacking (September 17) attacks the approval layer itself — the control that was supposed to compensate for the first two. Each exploits a different assumption: that agent inputs are safe, that installed tools are stable, that human approval means what it says.
Agentic AI is following the same security arc as early web development: rapid deployment, exploits that follow the trust assumptions, then hardened patterns that become industry standard. HITL is not wrong. It is necessary. But it is not sufficient unless the binding between approval and execution is technically enforced — not just architecturally intended.
The fix exists. It is an engineering problem, not a research problem. The frameworks that got this right prove it is solvable. The ones that got it wrong are patching now. The question is whether your deployment has caught up.