Human approval can be hijacked by mismatched operation presentations
Loopjacking: Hijacking Human-in-the-Loop Approval
Cryptography and SecurityMultiagent Systems
Summary
This paper finds that people who approve computer tasks might be tricked into agreeing to something different than what they saw. The authors call this problem loopjacking, where the approved action doesn't match what the computer ends up doing. They show two ways this happens: either the changed action is hidden during approval or the action is swapped afterward. Testing real products, they found some were vulnerable but others successfully stopped these tricks by checking approvals closely.
What this means in practice
- •For software security engineers: Improve software workflows by detecting and preventing mismatched approvals to block hijacked operations in automation platforms.
- •For automation platform developers: Build more secure AI agents by ensuring the operation a human approves matches exactly what executes, preventing unauthorized post-approval changes.
Authors
Adithyan Arun Kumar
Abstract
Human approval is often treated as the last security boundary before an agent executes a consequential operation. That boundary is only meaningful if the operation presented for review is the operation later authorized or released. We call failures of this binding Loopjacking: a human approves what they understand as operation A, while the implementation uses that decision for a materially different operation B. We distinguish two variants. In a representation-based attack, B is already encoded but omitted or misrepresented at approval time; in a post-approval state-substitution attack, the human sees the correct A and mutable workflow state later replaces it with B. We evaluate a purposive set of released agent products. We reproduce post-approval substitution in seven tested Agno AgentOS releases ending at 3.0.9 and in 12 tested versions of a conditional in-memory LangGraph Agent Server composition ending at 0.14.0. We reproduce representation mismatch in OpenClaw 2026.2.23 and its rejection in 2026.2.24. OpenAI Agents SDK 0.22.0 and 0.22.2 provide a negative control: serialized continuation preserves exact per-call binding and rejects mutated B. These results do not estimate ecosystem prevalence. They show that complete canonical approval rendering and exact use-time comparison, or preventing unauthorized pending-state mutation, block the tested attacks while preserving legitimate execution. We separate this contribution from established work on misleading dialogs, session smuggling, action binding, and authorization continuity.