Loading story…
Security researchers at Checkmarx have demonstrated a new attack technique called "Lies-in-the-Loop" (LITL), which targets the human-in-the-loop (HITL) safeguards used by AI agents. By forging approval dialogs, attackers can trick users into authorizing the execution of malicious code, even when a human review step is present. The attack works by embedding deceptive instructions into AI prompts, causing the approval dialog to misrepresent or hide the true nature of the action being authorized. This undermines the trust users place in HITL dialogs, effectively turning a security backstop into an attack vector.
The research highlights that simply involving a human in the approval process is insufficient to prevent prompt-level abuse, as attackers can manipulate what is displayed in the confirmation dialogs. Techniques include padding malicious payloads with benign text, pushing dangerous commands out of view, and generating misleading summaries. The researchers recommend that AI agent developers treat HITL dialogs as potentially untrustworthy, limit complex UI formatting, and ensure that the summary shown to users accurately reflects the actions to be executed. These findings underscore the need for more robust safeguards in AI-driven workflows, especially where high-privilege actions are involved.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Checkmarx publicly released its findings on the LITL technique and recommended mitigations, including constraining dialog rendering, limiting complex formatting, and verifying that approved actions match what users were shown. The publication emphasized that human approval alone is insufficient as a safeguard in AI-agent workflows.
Checkmarx reported the approval-dialog manipulation issue to Anthropic and Microsoft. Both companies acknowledged the report but did not classify the issue as a security vulnerability.
Checkmarx researchers discovered and documented a new attack technique called Lies-in-the-Loop (LITL), which manipulates human-in-the-loop approval dialogs in AI agents to trick users into authorizing malicious actions. The research showed attackers can alter dialog content, formatting, and presentation to hide or misrepresent dangerous code execution.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **Loopjacking**, a class of human-in-the-loop approval failures that enables an AI-agent workflow to execute a materially different operation from the one a user reviewed and approved. The attacks include representation mismatches, in which malicious actions are omitted or inaccurately displayed during review, and post-approval state substitution, in which mutable workflow data is altered after approval but before execution. Testing reproduced post-approval substitution across seven Agno AgentOS releases through `3.0.9` and 12 conditional in-memory LangGraph Agent Server compositions through `0.14.0`. A representation mismatch was reproduced in OpenClaw `2026.2.23`, while `2026.2.24` rejected the test; OpenAI Agents SDK `0.22.0` and `0.22.2` resisted mutated operations through serialized continuation and exact per-call binding. Recommended defenses include rendering complete canonical action details for approval, comparing those details exactly at execution time, and preventing unauthorized changes to pending workflow state.
Sep 23, 2026
New research shows that **AI assistants and coding agents can be manipulated by hidden or misleading instructions embedded in content they process**, creating a practical path to social engineering, data leakage, and potentially malicious command execution. LayerX reported that a **custom font and CSS-based rendering attack** can make a webpage appear harmless in the DOM while showing different instructions to the user in the browser, exploiting the gap between what AI systems analyze and what humans actually see. In its proof of concept, a page that looked like benign fanfiction at the HTML level rendered instructions that could steer a user toward executing a reverse shell, and the company said major AI assistants it tested failed to detect the threat. Separate research highlighted a related **semantic injection** risk in software repository `README` files used by AI coding agents. In testing, attackers embedded malicious setup-style instructions into documentation so agents would exfiltrate local files or other sensitive data to external servers during project setup, with reported success rates of up to **85%**. The benchmark, *ReadSecBench*, used 500 open source repositories across multiple programming languages and found the attack worked across agents using models from **Anthropic, OpenAI, and Google**, indicating that hidden-instruction attacks are not limited to one interface or vendor but reflect a broader weakness in how AI systems interpret untrusted content and operational guidance.
Jun 29, 2026
Security researchers and commentators warned that attacks on **LLM-based systems** are evolving beyond simple “prompt injection” into a broader execution mechanism dubbed **promptware**, with a proposed seven-step **promptware kill chain** to describe how malicious instructions enter and propagate through AI-enabled applications. The core risk highlighted is architectural: LLMs treat system instructions, user input, and retrieved content as a single token stream, enabling **indirect prompt injection** where hostile instructions are embedded in external data sources (web pages, emails, shared documents) that an LLM ingests at inference time; the attack surface expands further as models become **multimodal**, allowing instructions to be hidden in images or audio. Related academic work demonstrated a concrete multimodal variant against **embodied AI** using large vision-language models: **CHAI (Command Hijacking Against Embodied AI)**, which embeds deceptive natural-language instructions into visual inputs (e.g., road signs) to influence agent behavior in scenarios including drone emergency landing, autonomous driving, and object tracking, reportedly outperforming prior attacks in evaluations. Separately, reporting on a viral “AI caricature” social-media trend framed the risk as downstream **social engineering** and potential **LLM account takeover** leading to exposure of prompt histories and employer-sensitive data; while largely hypothetical, it underscores how widespread consumer LLM use and public oversharing can increase the likelihood and impact of prompt-driven compromise paths.
Jun 29, 2026