Loading story…
Researchers disclosed Loopjacking, a class of human-in-the-loop approval failures that enables an AI-agent workflow to execute a materially different operation from the one a user reviewed and approved. The attacks include representation mismatches, in which malicious actions are omitted or inaccurately displayed during review, and post-approval state substitution, in which mutable workflow data is altered after approval but before execution.
Testing reproduced post-approval substitution across seven Agno AgentOS releases through 3.0.9 and 12 conditional in-memory LangGraph Agent Server compositions through 0.14.0. A representation mismatch was reproduced in OpenClaw 2026.2.23, while 2026.2.24 rejected the test; OpenAI Agents SDK 0.22.0 and 0.22.2 resisted mutated operations through serialized continuation and exact per-call binding. Recommended defenses include rendering complete canonical action details for approval, comparing those details exactly at execution time, and preventing unauthorized changes to pending workflow state.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
Adithyan Arun Kumar submitted the paper “Loopjacking: Hijacking Human-in-the-Loop Approval,” defining approval-binding failures where a user approves one operation but a materially different operation is executed. The paper reported reproduced post-approval state substitution in tested Agno AgentOS and LangGraph Agent Server versions, plus a representation mismatch in OpenClaw 2026.2.23.
A Reddit user named adithyanak posted a link to the arXiv abstract for “Loopjacking: Hijacking Human-in-the-Loop Approval” in r/netsec. The captured post had no comments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers at Checkmarx have demonstrated a new attack technique called "Lies-in-the-Loop" (LITL), which targets the human-in-the-loop (HITL) safeguards used by AI agents. By forging approval dialogs, attackers can trick users into authorizing the execution of malicious code, even when a human review step is present. The attack works by embedding deceptive instructions into AI prompts, causing the approval dialog to misrepresent or hide the true nature of the action being authorized. This undermines the trust users place in HITL dialogs, effectively turning a security backstop into an attack vector. The research highlights that simply involving a human in the approval process is insufficient to prevent prompt-level abuse, as attackers can manipulate what is displayed in the confirmation dialogs. Techniques include padding malicious payloads with benign text, pushing dangerous commands out of view, and generating misleading summaries. The researchers recommend that AI agent developers treat HITL dialogs as potentially untrustworthy, limit complex UI formatting, and ensure that the summary shown to users accurately reflects the actions to be executed. These findings underscore the need for more robust safeguards in AI-driven workflows, especially where high-privilege actions are involved.
Jun 29, 2026
Research from Novee Security found that default AI agent harnesses from major vendors could be abused to exfiltrate secrets, bypass trust boundaries, and chain individually approved actions into harmful outcomes. Elad Meged reported multiple issues affecting Anthropic, Google, and OpenAI tooling, arguing that the root problem lies in architectural trust decisions, approval logic, and cross-stage handoffs rather than prompt injection alone. One Google Gemini CLI issue was tracked as **`GHSA-wpqr-6v78-jr5g`** with a **CVSS 10.0** rating, while weaknesses were also identified in Anthropic's Claude Code Action and OpenAI's Codex CLI sandbox. The findings showed how controls can fail when agent components such as tools, memory, prompts, and execution environments trust each other too broadly. Researchers said Google's agent could be pushed into a supply-chain-style attack that wrote to its own GitHub repository, illustrating how safe-looking steps can combine into exploitable workflows. Vendors have added mitigations and fixes, but the repeated pattern across products points to a broader industry problem for organizations deploying autonomous agents on untrusted input, especially where human review is limited or absent.
Jul 31, 2026
Auth0 warned that the most serious security risks in AI agents often stem from system design rather than the model alone, highlighting **agentic loops** and **multi-agent graphs** as architectures that can amplify prompt injection and unsafe automation. In loop-based systems, attacker-controlled external content can be fed back into an agent’s reasoning across multiple iterations, increasing the chance that malicious instructions persist, compound, and trigger irreversible actions before a human can intervene. The report said multi-agent graphs introduce additional trust-boundary failures because a compromised or manipulated agent can pass tainted instructions to downstream agents, spreading malicious behavior across the workflow. It cited 2024 research on **"Prompt Infection"** showing that prompt injection can self-replicate between connected agents, and recommended practical controls including strict step and time budgets, explicit approval gates for high-impact actions, narrowly scoped permissions, treating tool output as untrusted, and enforcing clear trust controls between agents as the term **agent** gains broader adoption in the industry.
Jul 24, 2026