The approval was real, the action was not — Loopjacking reaches released agent frameworks, and the fix being cited is an endpoint audit

A paper submitted to arXiv on 17 September 2026 by Adithyan Arun Kumar, an independent security researcher, names Loopjacking: a human approves what they understand as operation A while the implementation spends that decision on a materially different operation B, in two mechanically distinct variants - representation mismatch, where B is already encoded but the approval view omits the fields that make it B, and post-approval state substitution, where the human sees the correct A and mutable pending state is replaced before the decision is consumed. It is reproduced in released products: seven Agno AgentOS versions from 2.5.6 to 3.0.9 with five of five trials at 3.0.9, twelve tested versions of a conditional in-memory LangGraph Agent Server composition from 0.7.5 to 0.14.0, and OpenClaw 2026.2.23, with OpenAI Agents SDK 0.22.0 and 0.22.2 as a negative control that rejects the mutation three times of three because a serialized continuation preserves exact per-call binding. The obvious reading, that this is a framework bug waiting on a vendor patch, is wrong twice over: the Agno change now being cited alongside the research is pull request 10270, nine authorization guard fixes merged on 22 September 2026 whose content is endpoint authorization - user endpoint gating, reserved scope namespaces, request-time JWT checks - and which mentions neither approval workflows nor human-in-the-loop, while going the other way is worse still, because 2.5.6 is the established lower boundary only in that 2.5.5 ran the substituted operation without needing an approval at all. The second correction is that the LangGraph result is conditional on an authorization policy permitting a non-approver to update a shared pending thread, which is a configuration the deployer owns rather than a version number to bump. The European instrument already in force is DORA, Regulation (EU) 2022/2554, applicable since 17 January 2025: Article 9(3)(c) requires financial entities to prevent the impairment of the authenticity and integrity of data, and a pending task is data while an approval record whose action was swapped is no longer authentic - whereas the AI Act human-oversight duties sit in the Annex III chapter the Digital Omnibus moved to 2 December 2027, so outside the financial sector nothing in force reaches an approval gate. The practitioner move is the paper's own regression test: capture the approval view and the complete request, mutate one material field through each post-review surface, and assert the exact operation at the sink rather than the status code.

Post

An administrator read the transfer line by line: twenty units, approved vendor, signed off. Two thousand units left the account under that approval.

A paper published on 17 September names this Loopjacking and reproduces it in released products: a human approves operation A, the implementation spends that decision on operation B.

Flat:

  1. Two variants, needing different fixes. Representation mismatch: B is already in the request, but the approval view omits the fields that make it B. State substitution: the human sees the correct A, then mutable pending state is replaced before the decision is spent. Rendering the whole request fixes the first. Only a use-time comparison fixes the second.

  2. Agno AgentOS: seven released versions, 2.5.6 through 3.0.9, five of five trials at 3.0.9. LangGraph Agent Server: twelve tested versions, 0.7.5 through 0.14.0. OpenClaw 2026.2.23 vulnerable, 2026.2.24 rejects it. OpenAI Agents SDK 0.22.0 and 0.22.2 are the negative control: zero of six, because serialized continuation keeps the binding.

  3. Before you file this under "upgrade". The Agno change being cited alongside it is pull request 10270, nine authorization guard fixes merged 22 September: endpoint gating, scope namespaces, JWT checks. It is an endpoint-authorization audit, and says nothing about binding an approval to an action. Downgrading is worse — 2.5.6 is the lower bound only because 2.5.5 ran the substituted operation with no approval at all.

  4. For two of the three, no patch exists to wait for. LangGraph's result is conditional on an authorization policy that lets a non-approver update a shared pending thread — configuration you own, not a version you bump. And if you are an EU financial entity, DORA Article 9(3)(c) has required you since 17 January 2025 to prevent "the impairment of the authenticity and integrity" of your data. A pending task is data. An approval record whose action was swapped is not authentic.

My Monday: capture the approval view and the full request, mutate one material field through each post-review surface, then assert the exact operation at the sink, not the status code. Six cases, one afternoon — unchanged A passes, substituted B is rejected, a consumed approval cannot be replayed.

An approval gate records that a human decided. Binding that decision to an action is separate work, and three of the four tested had not done it.

Which of your approvals has anyone ever tried to substitute?

#AgenticAI #DORA #AIGovernance #DevSecOps #EUTech

First comment

Sources, primary first.

The paper itself — Adithyan Arun Kumar, independent security researcher, submitted 17 September 2026. Both attack variants, every version tested, and the mitigation written out as a procedure: https://arxiv.org/abs/2609.21081

The reproduction archive, with frozen package versions, dependency pins, test commands and SHA-256 manifests. Evidence cutoff 10 September 2026: https://github.com/adithyan-ak/loopjacking

The Agno pull request being cited around this — read it yourself and see whether anything in the nine fixes touches approval binding: https://github.com/agno-agi/agno/pull/10270

The write-up that first put that PR beside this research. Useful, and the reason I went and read the PR: https://byteiota.com/loopjacking-when-your-ai-agent-approves-a-runs-b/

DORA Article 9, protection and prevention — paragraph 3(c) is the one I quote, applicable since 17 January 2025: https://www.digital-operational-resilience-act.com/Article_9.html

LangChain's own human-in-the-loop documentation, for what the interrupt is designed to guarantee and what it leaves to your authorization policy: https://docs.langchain.com/oss/python/langchain/human-in-the-loop

One point I cut for length: most of you are not a financial entity, and DORA does not reach you. Nor does anything else in force — the AI Act's human-oversight duties sit in the Annex III chapter the Digital Omnibus moved to 2 December 2027, and an approval gate in your own CI was never Annex III anyway. So for most of us this is not a compliance item at all. It is an engineering defect with nobody scheduled to make us fix it.

Claims

Sources

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.