Daily Editions
The approval was real, the action was not — Loopjacking reaches released agent frameworks, and the fix being cited is an endpoint audit
A paper submitted to arXiv on 17 September 2026 by Adithyan Arun Kumar, an independent security researcher, names Loopjacking: a human approves what they understand as operation A while the implementation spends that decision on a materially different operation B, in two mechanically distinct variants - representation mismatch, where B is already encoded but the approval view omits the fields that make it B, and post-approval state substitution, where the human sees the correct A and mutable pending state is replaced before the decision is consumed. It is reproduced in released products: seven Agno AgentOS versions from 2.5.6 to 3.0.9 with five of five trials at 3.0.9, twelve tested versions of a conditional in-memory LangGraph Agent Server composition from 0.7.5 to 0.14.0, and OpenClaw 2026.2.23, with OpenAI Agents SDK 0.22.0 and 0.22.2 as a negative control that rejects the mutation three times of three because a serialized continuation preserves exact per-call binding. The obvious reading, that this is a framework bug waiting on a vendor patch, is wrong twice over: the Agno change now being cited alongside the research is pull request 10270, nine authorization guard fixes merged on 22 September 2026 whose content is endpoint authorization - user endpoint gating, reserved scope namespaces, request-time JWT checks - and which mentions neither approval workflows nor human-in-the-loop, while going the other way is worse still, because 2.5.6 is the established lower boundary only in that 2.5.5 ran the substituted operation without needing an approval at all. The second correction is that the LangGraph result is conditional on an authorization policy permitting a non-approver to update a shared pending thread, which is a configuration the deployer owns rather than a version number to bump. The European instrument already in force is DORA, Regulation (EU) 2022/2554, applicable since 17 January 2025: Article 9(3)(c) requires financial entities to prevent the impairment of the authenticity and integrity of data, and a pending task is data while an approval record whose action was swapped is no longer authentic - whereas the AI Act human-oversight duties sit in the Annex III chapter the Digital Omnibus moved to 2 December 2027, so outside the financial sector nothing in force reaches an approval gate. The practitioner move is the paper's own regression test: capture the approval view and the complete request, mutate one material field through each post-review surface, and assert the exact operation at the sink rather than the status code.
24 September 20269 verified claims8 sources
An administrator read the transfer line by line: twenty units, approved vendor, signed off.
Two thousand units left the account under that approval.
A paper published on 17 September names this Loopjacking and reproduces it in released products: a human approves operation A, the implementation spends that decision on operation B.
Flat:
1. Two variants, needing different fixes. Representation mismatch: B is already in the request, but the approval view omits the fields that make it B. State substitution: the human sees the correct A, then mutable pending state is replaced before the decision is spent. Rendering the whole request fixes the first. Only a use-time comparison fixes the second.
2. Agno AgentOS: seven released versions, 2.5.6 through 3.0.9, five of five trials at 3.0.9. LangGraph Agent Server: twelve tested versions, 0.7.5 through 0.14.0. OpenClaw 2026.2.23 vulnerable, 2026.2.24 rejects it. OpenAI Agents SDK 0.22.0 and 0.22.2 are the negative control: zero of six, because serialized continuation keeps the binding.
3. Before you file this under "upgrade". The Agno change being cited alongside it is pull request 10270, nine authorization guard fixes merged 22 September: endpoint gating, scope namespaces, JWT checks. It is an endpoint-authorization audit, and says nothing about binding an approval to an action. Downgrading is worse — 2.5.6 is the lower bound only because 2.5.5 ran the substituted operation with no approval at all.
4. For two of the three, no patch exists to wait for. LangGraph's result is conditional on an authorization policy that lets a non-approver update a shared pending thread — configuration you own, not a version you bump. And if you are an EU financial entity, DORA Article 9(3)(c) has required you since 17 January 2025 to prevent "the impairment of the authenticity and integrity" of your data. A pending task is data. An approval record whose action was swapped is not authentic.
My Monday: capture the approval view and the full request, mutate one material field through each post-review surface, then assert the exact operation at the sink, not the status code. Six cases, one afternoon — unchanged A passes, substituted B is rejected, a consumed approval cannot be replayed.
An approval gate records that a human decided. Binding that decision to an action is separate work, and three of the four tested had not done it.
Which of your approvals has anyone ever tried to substitute?
#AgenticAI #DORA #AIGovernance #DevSecOps #EUTech