Security researcher Adithyan Arun Kumar published a field note describing ‘loopjacking,’ an approval-binding failure he reproduced against LangGraph Agent Server’s shipped A2A JSON-RPC message/send route and human-in-the-loop middleware. In the tested composition a lower-privileged maker, who could update a shared pending thread but not approve or execute, sent a message.command.update that replaced a pending mock_wire_transfer(20, approved-vendor) with mock_wire_transfer(2000, attacker-sink) while reusing the same task, message, and tool-call IDs. When the approver later submitted the decision it had read for the original operation, the runtime reconstructed the call from current thread state and executed the substituted transfer under the approver’s authority, with no comparison between the approved view and the executed operation. Kumar frames the issue as implementation-level rather than a core A2A vulnerability, and notes the pre-clarification specification left approval scope implicit; A2A issue #2080 led to PR #2081, which added section 7.6.4 on July 30, 2026 stating that TASK_STATE_AUTH_REQUIRED signals a need for authorization rather than a grant for any operation and that implementations must define and check the scope. The strict trace ran across 12 released Agent Server versions from 0.7.5 to 0.14.0, the clarification was merged to main with v1.0.1 still the latest tag when checked, and the recommended defense is to bind the decision to a canonical executable operation and recheck it at the point of use.
Loopjacking in A2A Implementations: Hijacking Human-in-the-Loop Approvals
Security researcher Adithyan Arun Kumar published a field note describing 'loopjacking,' an approval-binding failure he reproduced against LangGraph Agent Server's shipped A2A JSON-RPC message/send route and human-in-the-loop middleware. In the tested composition a lower-privileged maker, who could update a shared pending thread but not approve or execute, sent a message.command.update that replaced a pending mock_wire_transfer(20, approved-vendor) with mock_wire_transfer(2000, attacker-sink) while reusing the same task, message, and tool-call IDs. When the approver later submitted the decision it had read for the original operation, the runtime reconstructed the call from current thread state and executed the substituted transfer under the approver's authority, with no comparison between the approved view and the executed operation. Kumar frames the issue as implementation-level rather than a core A2A vulnerability, and notes the pre-clarification specification left approval scope implicit; A2A issue #2080 led to PR #2081, which added section 7.6.4 on July 30, 2026 stating that TASK_STATE_AUTH_REQUIRED signals a need for authorization rather than a grant for any operation and that implementations must define and check the scope. The strict trace ran across 12 released Agent Server versions from 0.7.5 to 0.14.0, the clarification was merged to main with v1.0.1 still the latest tag when checked, and the recommended defense is to bind the decision to a canonical executable operation and recheck it at the point of use.
Source: Adithyanak