GoKawiilSecurity researchers demonstrate 'Loopjacking' flaw in LangGraph A2A approval flow
In a controlled test of LangGraph's Agent Server, researchers showed that a 'maker' role could swap a pending, human-approved transfer request for a different, much larger transfer after approval had already been granted. The approver signed off on a mock transfer of 20 units to an approved vendor, but the ledger recorded a transfer of 2,000 units to an attacker-controlled account under that same approval. The test used synthetic identities and a mock ledger, and the researchers published the request logs, decisions and exact software versions tested.