"Loopjacking": Approve One Agent Action, Execute Another, in LangGraph, Agno, and OpenClaw

Human-in-the-loop approval in LangGraph Agent Server, Agno AgentOS, and OpenClaw

Adithyan Arun Kumar published "Loopjacking: Hijacking Human-in-the-Loop Approval" (arXiv 2609.21081) on September 17, 2026, describing a class of failure where a human's approval of operation A is used to run a materially different operation B. Two variants are defined: representation attacks, where the approval view hides or misstates what will run, and post-approval state substitution, where pending workflow state is changed after the human signs off. Attacks reproduced against seven Agno AgentOS releases through 3.0.9, twelve LangGraph Agent Server versions through 0.14.0, and OpenClaw 2026.2.23, which was fixed in 2026.2.24. The OpenAI Agents SDK, versions 0.22.0 and 0.22.2, served as the negative control and resisted the attacks because it serializes the continuation and binds each approval to the exact call. The paper's fixes are rendering the complete canonical operation for approval and comparing it exactly at execution time, or preventing pending state from being mutated after approval

Approval bound to a description of an action rather than to the action itself. Anything that can edit the pending state between the click and the execution inherits the human's authority