Loopjacking: human approved one agent action while a materially different action executed

System

Framework

Agno AgentOS, LangGraph Agent Server, OpenClaw (A2A human-in-the-loop implementations)

Tools

a2a-approval-gate

Autonomy

human-in-the-loop

Classification

Primary class

excessive-agency

Chain

excessive-agency/missing-approval-gate → unsafe-action/unauthorized-write

Attack vector

untrusted-content

Causation

entity: both · intentionality: intentional · timing: post-deployment

Trigger

Two variants. In the representation variant, operation B is already encoded but the approval view omits or misrepresents its consequential details, so the human approves what they believe is A. In the post-approval state-substitution variant, the human reviews the correct A, then a party with update permission mutates the pending workflow state to B — reusing the same task and call IDs — and the earlier decision is consumed to release B. The proof of concept showed a mock transfer of 20 units to an approved vendor substituted, after review, for 2,000 units to an attacker-controlled sink, recorded under the approver's credentials.

Root cause

The approval decision is not bound to a canonical, immutable representation of the exact operation that later executes. Frameworks treated a generic "authorization required" signal and the pending operation as separable and mutable, so no use-time check confirmed that the executed operation matched the reviewed one. The A2A specification prior to section 7.6.4 did not define an approver, a canonical executable operation, an action-scoped grant, or the consequential sink, leaving the binding to each implementation.

Contributing factors

• Pending workflow state remained mutable after the operation was presented for approval.
• The approval grant was treated as covering the task generically rather than one specific action.
• The approval surface could render an incomplete or stale view of the operation's consequential details.
• No exact comparison of reviewed-versus-executed operation at use time.

Detection

Identified and disclosed by independent agentic-security researcher Adithyan Arun Kumar in a September 2026 arXiv paper and field note, with a public reproduction and evidence archive across tested framework versions.

Recovery

Responsibly disclosed. OpenClaw addressed the representation variant in release 2026.2.24 (vulnerable in 2026.2.23). The A2A specification added section 7.6.4 (PR #2081, merged 2026-07-30) clarifying that an authorization-required state signals a need for authorization rather than an implicit grant over any operation. The OpenAI Agents SDK (0.22.0, 0.22.2) was shown to bind each approval to the exact call and reject a changed one.

Prevention

Render complete canonical operation details for approval and compare them exactly at execution time; bind each approval to one specific, immutable action rather than to a task or request ID; prevent unauthorized mutation of pending state between review and release; reject execution when the use-time operation differs from the reviewed one.

Blast radius

Data

The flaw concerns action integrity rather than data disclosure; the demonstration altered the amount and destination of an operation, not stored data. n-a

User harm

No real-world harm reported. The demonstrated action class — a consequential operation (e.g. a funds transfer) executing with a different amount or recipient than approved — carries potential economic and property harm, shown against a mock ledger under the approver's credentials. none-reported

Scope

any A2A or human-in-the-loop agent framework that does not rebind a human approval to the exact executed operation; reproduced across tested releases of Agno AgentOS (through 3.0.9), LangGraph Agent Server (through 0.14.0 in the tested configuration), and OpenClaw (2026.2.23)

Reversibility

irreversible

References

OWASP LLM

LLM06

OWASP Agentic

T3

Tags

loopjacking human-in-the-loop a2a approval-integrity toctou

Sources

• Loopjacking: Hijacking Human-in-the-Loop ApprovalarXiv · academic · archived
• Loopjacking in A2A Implementations: Hijacking Human-in-the-Loop ApprovalsAdithyan Arun Kumar · primary-research · archived
• Loopjacking — evidence and reproduction archiveAdithyan Arun Kumar · primary-research · archived
• Agents Ran Actions Nobody ApprovedPixee · news · archived