Loopjacking: human-in-the-loop approval-binding bypass in agent frameworks (Agno AgentOS ≤3.0.9, LangGraph Agent Server ≤0.14.0, OpenClaw 2026.2.23) — arXiv research with reproduced PoCs

arXiv 2609.21081 (17 Sep 2026, independent researcher Adithyan Arun Kumar) defines and reproduces 'Loopjacking' — where the operation shown to a human for approval differs materially from the operation executed — in seven Agno AgentOS releases ending at 3.0.9 (post-approval substitution) and twelve LangGraph Agent Server compositions through 0.14.0, plus representation mismatch in OpenClaw 2026.2.23 (fixed next release). OpenAI Agents SDK served as the rejecting negative control. No CVE assigned.

Human-in-the-loop approval is widely recommended as the mitigation for risky agent actions (and is the de-facto control in many agent GUIs); this class shows that the approval button itself can be bypassed without any prompt injection, so defenders cannot assume approved operations are safe — they must verify approval-to-effect binding in the agent frameworks they run and keep low-privilege users from mutating pending approved operations.

Two variants: (1) representation-based — the harmful operation is fully encoded (e.g. hidden argv) but the approval dialog shows only an innocuous shell fragment; (2) post-approval state-substitution — the human approves the correct operation A, then mutable pending workflow state (e.g. a low-privilege requester's pending arguments) is swapped for a materially different operation B, and the agent executes B under the still-valid approval. Conservative characterization of mechanics only — the paper's reproductions do the evidence.

Agno AgentOS ≤ 3.0.9; LangGraph Agent Server (conditional in-memory composition) ≤ 0.14.0; OpenClaw 2026.2.23 (fixed 2026.2.24)

Enforce complete canonical rendering of the operation for approval and exact use-time comparison against what was approved; prevent untrusted actors from mutating pending approved state; for OpenClaw upgrade to 2026.2.24+. Vendors of the other two frameworks should add approval-to-effect binding checks; teams should not rely on a human-in-the-loop button as the sole control for consequential agent actions.