{"slug": "loopjacking-when-your-ai-agent-approves-a-runs-b", "title": "Loopjacking: When Your AI Agent Approves A, Runs B", "summary": "Security researchers published a paper on September 17 (arXiv 2609.21081) detailing a new attack class called Loopjacking that bypasses human-in-the-loop approval in AI agent frameworks by showing a human one operation and executing another. The post-approval state substitution variant was reproduced against LangGraph Agent Server across 12 tested versions up through v0.14.0 and against Agno AgentOS in seven releases from v2.5.6 through v3.0.9, while OpenAI Agents SDK v0.22.0 and v0.22.2 resisted the attack through serialized continuation. The Agno team has merged nine authorization guard fixes in PR #10270, and the paper recommends hashing the canonical serialized action before approval and verifying the hash before execution as the most reliable mitigation.", "body_md": "Security researchers have demonstrated that human-in-the-loop (HITL) approval — the industry’s most-deployed safeguard against AI agent overreach — can be bypassed without triggering sandboxes, without touching the model, and without leaving a trace in agent logs. The attack class, called **Loopjacking**, was detailed in a paper published September 17 ([arxiv 2609.21081](https://arxiv.org/abs/2609.21081)) and reproduced against two frameworks your production agents are likely running: LangGraph Agent Server and Agno AgentOS. The mechanism is straightforward: your agent shows a human one operation, receives approval, then executes a different one. That gap between what was approved and what runs is the vulnerability.\n\n## Two Ways to Break Approval\n\nThe paper identifies two distinct attack variants, each with a different root cause.\n\n**Representation mismatch** is the quieter form. Operation B is already encoded in the agent’s state before the approval prompt appears. The human sees operation A — or an incomplete, misleading description — approves it, and the system executes B. No state change happens after approval; the deception was baked in from the start. Detection is harder because the approval log looks clean.\n\n**Post-approval state substitution** is more aggressive. The human sees the correct operation A, approves it, and the approval is recorded. Then mutable workflow state is swapped for B before execution is dispatched. The approval event is real and legitimate; the substitution happens in the gap between authorization and execution. This is the variant reproduced in LangGraph and Agno.\n\nThe CSRF analogy holds: you think you authorized one thing; something else ran on your behalf. Except with AI agents, “something else” might mean deploying to production, sending emails, or modifying a database.\n\n## Which Frameworks Are Affected\n\n**LangGraph Agent Server** (LangChain): post-approval substitution reproduced across 12 tested versions, up through v0.14.0. The root cause is mutable pending-state that can be modified after a human approval event is recorded but before the action is dispatched to the executor.\n\n**Agno AgentOS**: reproduced in seven releases from v2.5.6 through v3.0.9. The Agno team has merged nine authorization guard fixes in [PR #10270](https://github.com/agno-agi/agno/pull/10270) — check whether your deployment has pulled that update.\n\n**OpenAI Agents SDK** (v0.22.0 and v0.22.2) was used as the positive control and found resistant. The SDK uses serialized continuation: the exact per-call action is serialized into run state along with approval metadata, and any mutation of the pending action after serialization is rejected before dispatch. This is the reference architecture to study if you’re building or hardening an approval pipeline. The [OpenAI Agents SDK human-in-the-loop documentation](https://openai.github.io/openai-agents-python/human_in_the_loop/) covers the implementation details.\n\n## What to Do Right Now\n\nIf you are running a production AI agent with HITL controls, this is the checklist:\n\n- **LangGraph Agent Server** : if you’re on v0.14.0 or earlier, review release notes for the post-approval substitution fix and upgrade. Check whether your composition uses in-memory conditional state (the vulnerable pattern) or immutable serialized state.\n- **Agno AgentOS** : pull PR #10270 or upgrade to a release that includes it. Verify the nine authorization guards are active in your deployment.\n- **Any framework** : audit the path between “approval recorded” and “action dispatched.” The action object shown to the human must be the same object passed to execution — no mutable state writable by any process after approval is given.\n- **Defense in depth** : hash the canonical serialized action before presenting it for approval; verify the hash before executing. This is deterministic pre-action authorization — the paper cites it as the most reliable mitigation regardless of framework.\n\nThe [reproduction archive on GitHub](https://github.com/adithyan-ak/loopjacking) includes harnesses that let you test your own approval pipeline against both attack variants. Running it against your stack before your adversaries do is worth the hour.\n\n## The Pattern\n\nSeptember 2026 has now delivered three distinct AI agent attack classes in under four weeks. GitSpawn (September 1) weaponizes the repository before the agent even starts. Plugin4Shell (September 18) injects via the plugin update pipeline. Loopjacking (September 17) attacks the approval layer itself — the control that was supposed to compensate for the first two. Each exploits a different assumption: that agent inputs are safe, that installed tools are stable, that human approval means what it says.\n\nAgentic AI is following the same security arc as early web development: rapid deployment, exploits that follow the trust assumptions, then hardened patterns that become industry standard. HITL is not wrong. It is necessary. But it is not sufficient unless the binding between approval and execution is technically enforced — not just architecturally intended.\n\nThe fix exists. It is an engineering problem, not a research problem. The frameworks that got this right prove it is solvable. The ones that got it wrong are patching now. The question is whether your deployment has caught up.", "url": "https://wpnews.pro/news/loopjacking-when-your-ai-agent-approves-a-runs-b", "canonical_source": "https://byteiota.com/loopjacking-when-your-ai-agent-approves-a-runs-b/", "published_at": "2026-09-24 01:07:49+00:00", "updated_at": "2026-09-24 01:26:56.749702+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence", "ai-tools"], "entities": ["LangGraph Agent Server", "LangChain", "Agno AgentOS", "Agno", "OpenAI Agents SDK", "arXiv 2609.21081", "PR #10270"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/loopjacking-when-your-ai-agent-approves-a-runs-b", "markdown": "https://wpnews.pro/news/loopjacking-when-your-ai-agent-approves-a-runs-b.md", "text": "https://wpnews.pro/news/loopjacking-when-your-ai-agent-approves-a-runs-b.txt", "jsonld": "https://wpnews.pro/news/loopjacking-when-your-ai-agent-approves-a-runs-b.jsonld"}}