Loopjacking: when the operation you approved is not the one that runs

What is this?

Human-in-the-loop approval is the control everyone reaches for. When an agent is about to wire money, delete a bucket or run a shell command, the accepted answer is: show it to a person and wait for a click. A paper submitted to arXiv on 17 September 2026 and announced in the cs.CR listing of 21 September 2026 — Loopjacking: Hijacking Human-in-the-Loop Approval (arXiv:2609.21081) by Adithyan Arun Kumar — asks the question that follows: is the operation a human reviewed the same operation the system later executes?

In several released agent products, the author reports, it is not. The paper names the failure class Loopjacking: a human approves what they understand as operation A, while product-owned logic uses that decision to authorize a materially different operation B. The approval is real, the click is genuine, the audit log says a human said yes — and the effect that reaches the sink is something else.

How it works

The paper states an approval-binding invariant: a decision may authorize an operation only when the complete operation evaluated at use time is materially equivalent to what the human reviewed, and only while the decision remains valid for the current principal, task and scope. “Complete operation” means the action, every material argument, the target resource, the principal and task scope, and any execution context that can change the effect. Two ways to break that invariant are distinguished.

• Representation-based Loopjacking. B is already encoded in the request before the decision, but the product displays or canonicalizes a materially incomplete A. The approval is accurate — for the wrong object. The paper’s shell-wrapper case is the clean illustration: the approval event represented only an inline payload, while the full positional argument vector prepared before approval carried the additional arguments that selected the real command and destination.
• Post-approval state substitution. The human sees and approves the exact A. Before the decision is consumed, an actor with a narrow state-update capability mutates the pending task, thread or continuation state to B. Execution then evaluates current B while retaining the decision made for A.

The attacker model is deliberately modest. No control of the model, no race against the approver, no forged confirmation: just asymmetric authority — a low-privilege task initiator, a repository writer or a remote agent that can update pending state but could never invoke B directly. The author explicitly excludes cases where B executes before any decision, where the approval prompt is skipped, or where a human knowingly approves a visible B. The experiments measure system binding, not human susceptibility: the approval role is scripted and only proceeds after the test has asserted and recorded the exact product view of A.

Four product paths were evaluated, as a purposive set rather than a sample. Post-approval substitution reproduced in seven tested Agno AgentOS release points ending at 3.0.9, where a continuation route matches the call identity but does not compare the current tool arguments against the descriptor in the approved record. It also reproduced in twelve tested versions of a conditional in-memory LangGraph Agent Server composition ending at 0.14.0, through the shipped A2A message-command update surface, under a stated authorization policy in which a maker may update a shared pending thread but not resume it. Representation mismatch reproduced in OpenClaw 2026.2.23 and was rejected in 2026.2.24, which added consistency checking over the complete argument vector.

The most useful result is the negative control. The OpenAI Agents SDK 0.22.0 and 0.22.2 rejected the mutation in every trial: serialized continuation preserves an exact per-call binding, and a same-call-ID invocation changed to B raised an error while the ledger stayed empty. Continuation and serialization are not, by themselves, the cause of the failure — binding is.

Why it matters

Approval is the control organisations lean on precisely when the stakes are highest, and it is the one that survives every threat model built on “the model may be compromised.” Loopjacking targets the plumbing beneath it. Three binding shortcuts are called out as insufficient: binding only a call identifier, when a reducer can replace the arguments attached to that identifier; binding only a run-level “approved” flag, when a continuation can install a different tool execution; and checking only at presentation time, when state can change before dispatch. All three are common, and all three produce a system that looks correct in a demo.

There is a second, converging result worth reading alongside it. Silence Is Endorsement: Verification-Status Laundering in LLM Agent Pipelines (arXiv:2609.20211), submitted 25 July 2026 and announced in the listing of 18 September 2026, examines the same gap one layer up, where an LLM monitor rather than a human is the gate. When the framing that an authorization claim was unverified is stripped out — by a summarizer, a memory compressor, an ordinary handoff — approval of risky actions rose from 5% to 60% on Llama-3.1-8B and from 9% to 98% on Qwen2.5-14B in the reported experiments, with a full proposer–summarizer–memory–monitor pipeline reaching 57–81% across three downstream monitors. Instructing monitors to reject unverified authorization is reported as not a reliable cross-model fix.

The two papers point the same way. Authorization decisions in agent systems are being carried as text and flags through lossy pipelines, when they need to be carried as structured state bound to the exact effect.

Defenses

The Loopjacking paper’s prescription is a single rule: preserve the operation the human approved, reconstruct the operation that will actually execute, and compare their complete canonical descriptors at the last authorization point — after all parsing, templating, state reduction, continuation, default insertion, wrapper expansion and argument resolution.

Make the approval record canonical. It should bind the action or tool identity and every material argument, the target resource and side-effect class, the initiating principal and task scope, the approving principal, a nonce with creation time, expiry and consumption status, and a digest over the same complete descriptor shown to the human. The display must be generated from that descriptor, not from a convenience string while execution uses a richer object.

Do the real check at use time, not at render time. The paper’s procedure, immediately before releasing the effect: reject if the decision is missing, expired, revoked, consumed or out of scope; reject or re-request approval if the current operation differs materially from the approved descriptor; re-evaluate current policy over the resolved effect; atomically consume the decision with the release of the effect, or record an idempotent commit token that prevents replay; append approved descriptor, current descriptor, decision and effect to an audit record.

Give shell and command wrappers special attention. Inline payloads, positional arguments, environment changes, working directory, interpreter flags and redirections all change the effect. A collapsed view can remain useful, but approval must either expose material hidden fields or refuse to authorize them.

Treat mutation prevention as depth, not as the answer. Denying a non-approver the ability to update a shared pending thread blocked the state variant in the tested LangGraph composition, and that is worth doing where business roles allow it. It is composition-specific, and it does not replace exact-action binding wherever legitimate updates, retries or migrations can change operation state.

Test it as a regression, every release. Capture the approval view and the complete request, mutate one material field through each supported post-review surface, and assert the exact operation at the sink. The minimum suite: unchanged A succeeds; denial has no effect; direct B is unavailable to the attacker; an A-to-B substitution is rejected or re-authorized; wrong scope fails; a consumed or expired approval cannot be replayed.

Carry authorization provenance as structured state. The companion study’s conclusion applies to LLM monitors as much as to human ones: whether a claim was verified must travel attached to the claim, in a field a summarizer cannot quietly drop.

Status

Aspect	Detail
Primary source	Loopjacking: Hijacking Human-in-the-Loop Approval (arXiv:2609.21081), submitted 17 September 2026, announced 21 September 2026
Class	Approval-binding failure — the decision is not bound to the operation evaluated at use time
Variants	Representation-based (incomplete view at approval); post-approval state substitution (pending state mutated before consumption)
Reproduced	Post-approval substitution: seven Agno AgentOS release points ending at 3.0.9; twelve versions of a conditional in-memory LangGraph Agent Server composition ending at 0.14.0. Representation mismatch: OpenClaw 2026.2.23
Fixed / rejected	OpenClaw 2026.2.24 (complete argument-vector consistency check). OpenAI Agents SDK 0.22.0 / 0.22.2 as negative control — mutation rejected in every trial
No established fix	The paper states no fixed Agno release and no vendor-fixed LangGraph release at its cutoff; the Agno exact-action control is research-authored, and the LangGraph safe outcome is a supported deny-update policy
Scope caveats	Purposive set, not a random sample; results configuration- and version-specific; no prevalence estimate; no CWE or CVSS assigned; single researcher, no independent reproduction; production Postgres deployment not evaluated
Related work	Silence Is Endorsement (arXiv:2609.20211), submitted 25 July 2026, announced 18 September 2026 — the same binding gap where an LLM monitor is the gate
Study cutoff	Evidence and public-source review current through 10 September 2026