Security researchers demonstrate 'Loopjacking' flaw in LangGraph A2A approval flow

GoKawiil Brief

In a controlled test of LangGraph's Agent Server, researchers showed that a 'maker' role could swap a pending, human-approved transfer request for a different, much larger transfer after approval had already been granted. The approver signed off on a mock transfer of 20 units to an approved vendor, but the ledger recorded a transfer of 2,000 units to an attacker-controlled account under that same approval. The test used synthetic identities and a mock ledger, and the researchers published the request logs, decisions and exact software versions tested.

Why It Matters

GoKawiil's interpretation of the reporting above, not reported fact.

The findings suggest that some Agent2Agent (A2A) implementations track approval by Task ID rather than by binding the human's decision to the specific operation approved, which could let an attacker substitute a materially different action after approval without alerting the reviewer. This points to a broader design question for human-in-the-loop systems: whether approval mechanisms verify 'this exact operation' or merely 'this task thread', a distinction the researchers argue current A2A guidance does not clearly resolve. If unaddressed, similar substitution attacks could affect other agent frameworks that rely on task-level rather than operation-level authorization checks.

Key Takeaways

Testers swapped a pending 20-unit approved transfer for a 2,000-unit transfer to an attacker account after human approval was already granted.
The exploit relies on A2A's Task model, which tracks a continuing unit of work by ID rather than binding approval to one exact operation.
Full evidence, including requests, decisions, and tested software versions, was published for verification.

Source: adithyanak.com — Adithyan Arun Kumar, 2026-09-23

Published there as: “Loopjacking in A2A Implementations: Hijacking Human-in-the-Loop Approvals”

Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.