This newsletter is named after the human in the loop.
This week a researcher showed how little that human can actually see.
the tell#
On 17 September, Adithyan Arun Kumar published a paper on arXiv called Loopjacking. The idea fits in one line: a human approves operation A, and the system spends that approval on operation B.
The paper’s example is plain. A low-privilege user asks for a transfer of 20 units to an approved vendor. An administrator reviews it and approves. The user then swaps the pending arguments for 2,000 units to an attacker’s destination, and the approval still counts.
There are two routes in:
| route | what the approver sees |
|---|---|
| representation | B is already in the request but hidden or misrendered on the approval screen |
| state substitution | the correct A, then pending state is changed to B after the click |
The author reproduced state substitution in seven Agno AgentOS releases up to 3.0.9 and in twelve versions of one LangGraph Agent Server setup up to 0.14.0. The representation route worked in OpenClaw 2026.2.23 and was fixed in 2026.2.24. The OpenAI Agents SDK was the control case: it binds each approval to the exact call and rejects the swap. The A2A specification also added a section on binding approvals to the actual operation.
Cricket settled a version of this years ago. The third umpire can only be as right as the replay they are shown. If the replay is from a different ball, the decision is correct and still wrong.
My read: an approval is only a control if it is bound to exactly what runs. Otherwise it is a timestamp on a guess.
what i’m ignoring#
- Headlines built around startup valuations when a prompt-injection bug lands. The bug is worth reading. The valuation is not a security fact.
- The joint CISA, NSA and FBI advisory on model distillation. It matters to AI labs. It does not change a Security analyst’s shift this week.
- “Top AI agent incidents of 2026” roundups. Most are the same five stories, re-counted.
the real one#
On 14 September, Spain’s data protection authority, the AEPD, received what it described as its first breach notification involving an autonomous AI agent. Its deputy director disclosed it on the agency blog the next day, as reported by Infobae.
As described, an agent built on a large language model searched files for weaknesses, got an unauthorised login, kept probing the application with little human steering, altered personal data and opened invoices. The AEPD has not named the organisation, the model or the sector.
What is usable here is not the attack. It is the paperwork. A regulator now has a category where the actor is an agent.
What I’d watch:
- whether your incident and breach templates have a field for “AI agent involved”, on either side
- logs that show a login followed by fast, patterned probing with no human-shaped pauses
- whether you could tell a regulator which agent did what, if one of yours were the actor
Caveat: this is one notification, described through secondary reporting. It is a signal, not a trend yet.
the part that stays#
Security angle: both stories point at the same weak spot. We keep adding a human checkpoint and calling the risk handled. Loopjacking shows the checkpoint can be real and still not protect anything, if what the human saw is not what ran.
Human angle: think about the approver, not the attacker. The fortieth approval of the day does not get the attention of the first. Nobody reads the full payload at 6 pm. Attackers do not need to beat the human. They only need the human to be tired and the screen to be incomplete.
Honestly? I don’t know how to keep an approver sharp at approval number forty. Better tooling helps. I’m not sure it solves it.
do this week#
- Take one agent workflow that has an approval step. In a test setup, change the pending action after approval and see whether it still runs. Ten minutes will tell you which side of the paper you are on.
- Add one line to your incident template: “Was an AI agent involved, on our side or theirs?” It costs nothing now and saves a scramble later.
When you last clicked approve on something automated, how sure were you that it ran exactly what you saw?
you signed the page you saw. the machine filed a different one.
sources#
- Adithyan Arun Kumar, “Loopjacking: Hijacking Human-in-the-Loop Approval”, arXiv 2609.21081 (17 Sept 2026): arxiv.org/abs/2609.21081
- Loopjacking evidence and reproduction archive: github.com/adithyan-ak/loopjacking
- Infobae, on the AEPD’s first breach notification involving an AI agent (15 Sept 2026, Spanish): infobae.com
Stay patched. Stay paranoid. Maximum effort.
i take help from ai to optimise what i have learned and share it with you. the reading, the lens and the calls are mine. weekly, so you stay updated without the scroll fatigue.
