Loopjacking preprint reproduces post-approval substitution in shipped Agno AgentOS and LangGraph agent server versions

Sources: primary
Summary: The preprint at arXiv 2609.21081 describes loopjacking, where the action a human approves at a human-in-the-loop gate is replaced with a different action before it executes. The authors report reproducing it against shipped versions of Agno AgentOS and the LangGraph agent server. It is a preprint and carries no external review.
Why it matters: The approval gate is the control most agent deployments rely on for dangerous actions, and it only holds if what executes is bound to what the human was shown.