CLAIM-2026-09-24-01

Loopjacking is defined in a paper submitted to arXiv as 2609.21081 on 17 September 2026 by Adithyan Arun Kumar, an independent security researcher: a human approves what they understand as operation A while the implementation uses that decision for a materially different operation B, in two variants - representation-based attack and post-approval state substitution.

Why it matters

It names and separates two failure modes that teams treat as one, and the separation decides which mitigation actually applies: complete canonical rendering fixes the first, use-time comparison the second.

Sources

• arxiv2026loopjacki