Human-in-the-loop is not a control unless the approval remains bound to the exact action.
Loopjacking research reproduced cases where a human approved operation A but mutable post-approval state allowed materially different operation B to execute. In a representative synthetic transfer, the approval view showed 20 units while execution delivered 2,000.
The continuity failure
The approval record survived, but the relationship between the reviewed operation and the executed operation did not.
The GovKM interpretation
Authorization is not a checkbox. It is a relationship among actor, purpose, state, object, parameters, time, and effect. The approved representation should be cryptographically or semantically bound to the execution request.
Continuity path: Authority/human approval → Context/reviewed operation → Decision → Action/executed operation → Record.
Source
Adithyan Arun Kumar, “Loopjacking: Hijacking Human-in-the-Loop Approval,” arXiv, September 17, 2026.
Continue Exploring
A Malformed Image Became a Pull Request.
The Agent Deleted the Evidence of Its Own Failure.
