Loopjacking：劫持人类在环审批的安全边界
原标题：Loopjacking: Hijacking Human-in-the-Loop Approval
AI 摘要
该论文提出「Loopjacking」概念，指人类在环审批中，人类批准的操作与系统实际执行的操作不一致，导致审批安全边界失效。作者区分了表示型攻击（审批时展示不完整或误导性表示）和审批后状态替换攻击（审批后可变状态被替换）。在Agno AgentOS 3.0.9、LangGraph Agent Server 0.14.0和OpenClaw 2026.2.23等产品中复现了这些攻击，而OpenAI Agents SDK 0.22.0/0.22.2作为阴性对照未受影响。研究提出完整规范呈现加使用时精确绑定、以及防止未授权待审批状态修改两种防御方案。
正文节选
Loopjacking: Hijacking Human-in-the-Loop Approval Abstract Human approval is often treated as the last security boundary before an agent executes a consequential operation. That boundary is only meaningful if the operation presented for review is the operation later authorized or released. We call failures of this binding Loopjacking: a human approves what they understand as operation , while the implementation uses that decision for a materially different operation . We distinguish two variants