Google ADK shipped the same class of fix.

v1.38.0 and v2.6.3, both August 7, port "prevent continuation forgery in tool confirmation," now validating that a confirmed target tool is registered in the executing agent's tools_dict, that it genuinely requires confirmation, and that the original tool-call event exists in session history with matching ID, name and arguments. PR #6597 removes shell execution from ReadFileTool ranged reads. Two frameworks, same week, same root cause: approvals checked against model-supplied identifiers instead of server-held state.