Loopjacking: human approval boundaries reproduced as broken in shipped Agno, LangGraph and OpenClaw releases
The paper names a failure where a human approves operation A and the runtime executes a materially different operation B, split into representation-based attacks (B already encoded but hidden at approval time) and post-approval state substitution (mutable workflow state replaces A after the click). The authors reproduce post-approval substitution in seven Agno AgentOS releases through 3.0.9 and twelve versions of a conditional in-memory LangGraph Agent Server composition through 0.14.0, and representation mismatch in OpenClaw 2026.2.23 with its fix in 2026.2.24. OpenAI Agents SDK 0.22.0 and 0.22.2 serve as a negative control because they serialize the approved call, which is the concrete design lesson: bind the approval to an immutable serialized operation, not to a mutable state handle.
↳ Follow the thread