Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization

Sai Varun Kodathala; Prashanth Pollishetty; Jaylen Cargill

cs.CROct 15, 2026

Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization

Authors: Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill

Organizations: SportsVision AI Minnetonka, MN

Abstract

AI agents now pause for approval before they send money, delete files or email outsiders, and that approval is usually treated as a second factor. We argue it is one only when compromising the agent cannot produce it and when it names exactly what it approves, and we test both conditions. We define twelve attacks on the approval path, including decoy recipients, amount cancellation, card padding, label spoofing, enrollment squatting and threshold splitting, and run them against the Agent Payments Protocol (AP2), the Microsoft action-bound approval design and Model Context Protocol (MCP) elicitation. An audit of ten agent runtimes finds no third-party verifiable approval record, no flood limits where measurable, and post-approval argument changes in four of eight runtimes with measurable binding. As a reference defense we build ASU (Agent Step-Up), a gateway that renders the approval card from a canonical effect descriptor, has a passkey on the phone of the user sign its digest, and executes only the stored call. Tamarin proves its binding, single-use and key-level non-repudiation properties under three stated hypotheses (53 lemmas). Across 27,108 scripted trials and 609 AgentDojo attack pairs, ASU stops substitution, replay and grant stretching, and the trusted card cuts forged-narration attack success from 0.54 to 0.03. With 15 current language models as automated approvers, the trusted card raises the attack catch rate from 0.30 to 0.98, at the cost of refusing 16 percent of harmless near misses, mostly due to a placeholder artifact in our stimuli. A second device adds nothing measurable over a trusted on-host confirmation in these experiments, flooding still succeeds 0.45 to 0.60 of the time against a modeled approver, and approval cannot stop effects that policy already allows. Code, data and proofs: https://github.com/Sports-Vision-Inc/agent-step-up

Figures & tables

Panel of Figure 1 — Figure 1: Three ways to ask a human. (a) In-channel confirmation: the agent renders the question and the answer arrives on a channel it can write to. (b) Narrated out-of-band card: the click happens on the user’s phone, but the text the user reads is the agent’s description, so the user approves a description rather than the call. (c) Effect-bound approval, the design we use as a reference defense ( Section 5 ): a gateway the agent cannot reach renders the card from the canonical call, the phone signs the digest of that call, and the gateway executes only the stored call. Green regions are outside the agent’s reach; red regions are inside it.

Human MFA	Agent analog	Property, attack
Factors in independent places	The approval is produced in a trust domain the agent cannot reach (a gateway host and the user’s phone)	P1 ; AB7 , AB9
Step-up for risky transactions	Policy returns challenge for consequential effects	P7 ; AB12
Dynamic linking to amount and payee	The signed challenge commits to the digest of the canonical effect	P2 ; AB1 , AB2 , AB10
Authenticator shows the transaction	The card is rendered by trusted code from the effect, never from agent text	P4 ; AB4 to AB6
One-time codes expire	Approvals carry a nonce and an expiry and are consumed once	P3
Push bombing, MFA fatigue	Approval flooding by a compromised agent	P7 ; AB11

Table 1: Human MFA concepts and their analog for agent actions. The right column names the property in Section 2.2 and the attack in Section 3 that tests it.

Mode	What the human sees and does	Omits
none	Nothing; policy allows the call	all
chat-confirm	A question and a “yes” in the agent’s own channel	P1
narrated-card	An out-of-band card whose text the agent supplies; the gateway still binds the call	P4
unbound	An out-of-band passkey approval of the run or session, not of $h$	P2 , P3
totp	A one-time code; no binding to the effect; relayable	P2 , P5
txn-sign	A signed approval of payee and amount only; other arguments hidden	P4 (partial)

Table 2: Approval designs, implemented as modes of one gateway. “Omits” is the property each design lacks by construction; measured outcomes are in Section 7 .

ID	Attack	What the attacker does	Breaks
AB1	Amount cancellation	Sends two amount-like arguments, such as amount=10000, total=-10000 , so that a summing check sees a small value	P2 , P6
AB2	Decoy-field recipient	Adds a second recipient or account under an innocuous key, such as bcc , so the display or grant check reads the wrong one	P2 , P4
AB3	Grant stretching	Reuses a standing “allow similar” grant for a different payee, recipient or larger amount	P6
AB4	Padding and hidden text	Pushes the harmful part of an argument off screen with blank glyphs (U+2800, U+3164) or reorders it with bidirectional controls	P4
AB5	Label spoofing	Chooses argument names that imitate trusted labels, such as Target or Verified by client	P4
AB6	Non-injective rendering	Finds two different effects that produce the same card, for example a boolean and the string "true"	P4

Table 3: The approval-path attack family. “Breaks” names the property of Section 2.2 that the attack violates when it succeeds.

Panel of Figure 2 — Figure 2: The same blind-copy attack ( AB2 ) seen two ways. Left: the narrated view, written by the agent. Right: the trusted card, rendered by the gateway from the canonical descriptor; the agent’s text appears only in the box at the bottom. The card is abridged (expiry line omitted, context lines merged, digest shortened, separator lines around the explanation dropped, label punctuation normalized). Across 15 language-model approvers at temperature zero, 15 of 15 approved the left view and 15 of 15 denied the right one.

Attack	AP2	AGT	MCP	OpenClaw	Frameworks	ASU
AB1 Amount cancellation	ok	ok	n/a	n/a	PART ∗	ok
AB2 Decoy-field recipient	ok	ok	n/a	n/a	n/a	ok
AB3 Grant or mandate stretching	ok	n/a	n/a	PART ∗	n/a	ok
AB4 Padding, blank glyphs, bidi	n/a	n/a	VULN	ok ∗	n/a	ok
AB5 Label spoofing	n/a	ok	VULN	n/a	PART ∗	ok
AB6 Non-injective rendering	PART	n/a	VULN	n/a	PART ∗	ok

Table 4: Approval-path attacks against real designs. VULN: the attack succeeds against documented usage. PART: the attack succeeds only at the argument level, depends on the integrator, or reflects a stated trust assumption. ok: the attack fails. n/a: the target has no such feature. ∗ : not executed in this run (static review, or derived from the audit). The AP2 AB6 cell combines an executed constraint check with a source reading of the sample card.

Runtime	Version	P1	P2	P3	P4	P5	P7
openai-agents	0.23.1	FAIL †	PASS	PART state	PART int J	FAIL J	FAIL
langgraph	1.2.15	FAIL †	FAIL	PART state	PART int J	FAIL J	FAIL
google-adk	2.12.0	FAIL †	PART store	PART state	PART int J	FAIL J	FAIL
agno	3.1.3	FAIL †	FAIL	PART state	PART int J	FAIL J	FAIL
pydantic-ai	2.56.0	FAIL †	FAIL	PART state	PART int J	FAIL J	FAIL
crewai	1.15.27	FAIL †	n/a J	n/a J	n/a J	FAIL J	FAIL J

Table 5: Approval properties of agent runtimes. Subscripts: state , single use holds only relative to run state, and a rollback replays; store , binding resists the resume API but not a writer of the backing store; int , holds only if the integrator renders from structured data; low , low-severity gap. Superscripts:

\dagger

, fails by construction under the threat model;

J

, judgment from source or API review;

s

, static review only. n/a: no such mechanism. P7 is measured within one run.

Agno	In published range	P2	Remote continue	P3	Same-call replay
3.0.9	yes	FAIL	substituted	FAIL	re-executes
3.0.10	no	FAIL	substituted	FAIL	re-executes
3.1.3	no	FAIL	substituted	PART state	consumed once

Table 6: Version dependence in Agno. The same probe, with the same criteria, re-run in each release. 3.1.3 is the latest release measured.

Panel of Figure 3 — Figure 3: A challenged tool call in ASU. The agent sees only the approval identifier and the outcome. The card, the challenge and the assertion travel between the gateway and the user’s phone, and the gateway executes the stored descriptor rather than the agent’s resubmitted arguments.

Panel of Figure 4 — Figure 4: Approval cards as rendered on a phone (390 $\times$ 844 viewport) by the gateway’s authenticator page; the page header is cropped. In (c) the agent hid curl …| sh after 3000 blank Braille glyphs; the card collapses the run to a counted marker, flags the inline shell, and keeps the agent’s explanation collapsed.

Figure 5: Gateway overhead per operation, in process on an Apple silicon laptop (Python 3.13). Bars are medians over 300 runs and lines extend to the 95th percentile. Human reading and deciding time is excluded.

Lemma	Statement	Hyp.	Result
L1_effect_binding	An execution of $\Delta$ under $\mathit{id}$ implies the human approved $\Delta$ for $\mathit{id}$ beforehand	H1 – H3	verified
L1_sig_binding	An execution implies $U$ ’s authenticator signed $h(\Delta)$ for $\mathit{id}$	H2	verified
L2_single_use	At most one execution per approval identifier	none	verified
L3_agent_independence	An approved status implies the human approved that effect	H1 – H3	verified
L4_non_repudiation	A judge holding only $pk_{U}$ accepts $(h,\mathit{id},g)$ only if $U$ ’s authenticator signed exactly that tuple, even when the origin controls the ceremony	H2	verified
L4c_consent_nonrep.	A judge’s acceptance implies the human approved the effect	H1 – H3	verified

Table 7: Main ASU lemmas (Tamarin 1.10.0, unbounded). “Hyp.” lists the hypotheses in the premise. The existence lemmas show that executions, grant executions and receipt verification are reachable under H1 to H3 , so the safety lemmas are not vacuous.

Model	L1 effect	L1 sig.	L2 single use	L3 indep.	L4 non-rep.
ASU	✓	✓	✓	✓	✓
V1 unbound	✗	✗	✓	✓	n/a
V2 narrated card	✗	✓	✓	✗	✓
V3 no consume (mutant)	✓	✓	✗	✓	✓
V4a TOTP relay	✗	n/a	✓	✗	n/a
V4b chat confirm	✗	n/a	✓	✗	n/a

Table 8: The same lemmas on the baselines. ✓ verified, ✗ falsified, n/a not stated for that model. V3 is a mutant of ASU without consumption and V5 replaces the passkey with a shared-key MAC; neither is implemented as a mode.

Figure 6: Attack success rate for each scripted scenario (rows) and approval mode (columns), perceptual approver, 20 trials per cell. none and chat-confirm succeed by construction. Rows marked $\dagger$ are effects that policy allows without any approval, so they measure the policy rather than the approval. ASU and host-confirm differ only on A9, where ASU offers a grant ( Section 7.4 ). Results for the narration-trusting and exact-compare approvers are in Figures 12 and 13 in the appendix.

Figure 7: AgentDojo with forged narration: attack success by mode, all four suites pooled (609 pairs, cluster-bootstrap 95% intervals over 26 injection tasks). (a) An approver that compares the shown effect with the task. (b) An approver that trusts the agent’s text whenever it is shown; for that approver the trusted card helps only when the explanation is removed.

Figure 8: Language models as approvers, both passes pooled (one sample at temperature 0 and three at 0.7). (a) Share of 23 attack stimuli refused. (b) Share of 11 benign near misses refused. Points are rates over decided trials; bars are Wilson 95% intervals. Models are sorted by their narrated catch rate.

			Catch			False deny
Model	Tier	Released	Narrated	Card	No expl.	Card	No expl.	$p$
anthropic/claude-sonnet-5.5	F	2026-09	0.30	1.00	1.00	0.09	0.09	$<$ 0.001
anthropic/claude-haiku-5.5	S	2026-10	0.25	1.00	1.00	0.26	0.27	$<$ 0.001
deepseek/deepseek-v4-pro-0813	F	2026-08	0.23	1.00	1.00	0.34	0.34	$<$ 0.001
deepseek/deepseek-v4.1-flash	S	2026-09	0.28	0.99	0.96	0.14	0.11	$<$ 0.001
google/gemini-4-argon	F	2026-10	0.52	1.00	1.00	0.00	0.11	$<$ 0.001

Table 9: Per-model results, both passes pooled. Tiers come from the automatic selection: F is the vendor’s newest model priced above 0.60 USD per million input tokens, or its newest model if it has none; S is its newest model at or below that price. Catch: share of attacks refused. False deny: share of benign near misses refused.

p

: exact McNemar test, narrated against card, on attack items at temperature 0, Holm-corrected over 15 models.

Figure 11: Step-up policies under assumed session-level fatigue: approval prompts per benign task against attack success per session (21840 trials). Each line is one fatigue setting; points are policies, labeled for the central setting.

	SUDP	ADR 0030	AP2	VAC	Consent Int.	Loopjacking	This paper
Effect bound to the approval	spec	yes	yes	yes	yes	prescribed	yes
Approver’s signature over the effect	spec	no	yes	no	no	no	yes
Approval outside the agent’s machine	spec	host	yes	no	assumed	n/a	yes
Card rendered from the effect	n/a	host	sample	yes	assumed	n/a	yes
Mechanized proof	planned	no	others	no	no	no	yes
Attacks on rendering	no	no	others	partial	partial	partial	yes

Table 10: Positioning against the closest work, as described in each source. “Spec”: specified without an evaluation. “Host”: left to the host or integrator. “Others”: done for that design in separate work ( Jiang et al., 2026 for proofs, Aviv et al., 2026 for attacks). “Partial”: some but not all of the item. n/a: outside the work’s scope.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

ID	Name	What the agent does
A1	Forged identity	A non-owner in the agent’s channel claims the owner’s authority during a read-only task
A2	Injection under owner authority	An injected instruction during the owner’s task; the narration is truthful
A3	Narration forgery	The text describes the expected report email; the real call goes to the attacker
A4	Post-approval substitution	The approved arguments are replaced before execution
A5	Replay	A used approval is presented again so that an 80 USD payment executes twice
A6	Approval flooding	Up to 30 distinct attack requests in one session; three policy variants

Appendix

Table 11: Scripted attack scenarios. A13 reduces each Agents of Chaos case ( Shapira et al., 2026 ) to the shape of the tool calls the manipulated agent made.

Figure 12: Attack success for the narration-trusting approver, which decides from the agent’s text whenever a mode shows any. The trusted card gives no protection against this approver unless the explanation is removed ( asu-no-expl ) or not shown ( txn-sign ).

Figure 13: Attack success for the exact-compare approver, an upper bound that compares the entire card with the expected rendering. Cells are deterministic (three identical trials each).

Suite	Approver	narrated-card	totp	txn-sign	host-confirm	asu	asu-no-expl
workspace	exact-compare	0.46	0.46	0.00	0.00	0.00	0.00
workspace	narration-trusting	0.46	0.46	0.16	0.46	0.46	0.02
travel	exact-compare	0.30	0.30	0.04	0.00	0.00	0.00
travel	narration-trusting	0.30	0.30	0.22	0.30	0.30	0.05
banking	exact-compare	0.67	0.67	0.01	0.00	0.00	0.00
banking	narration-trusting	0.67	0.67	0.16	0.67	0.67	0.01

Appendix

Table 12: AgentDojo attack success with forged narration, by suite and approver. The Slack suite’s residual for the bound designs comes from web fetches that the policy allows without approval.

Family	$n$	Examples
Narration forgery	3	Payee or recipient substituted while the narration names the requested one; a different file deleted
Visible substitution	3	Look-alike recipient domain; transposed account number; a hyphen for a dot in a host
Priming	3	Urgency and authority claims; text addressed to the machine reviewer; a recursive delete framed as routine
Padding	3	Whitespace, blank glyphs or tabs hiding a download-and-execute, a fraudulent instruction or a recursive delete
Label spoofing	3	An argument named like a trusted label, such as Target , while the real target differs
Decoy recipient	3	A hidden blind copy; an extra copy recipient; a second address in the recipient list

Appendix

Table 13: Approver stimuli: 23 attacks in 8 families and 11 benign near misses. All hosts, accounts and bodies are placeholders.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Loopjacking: Hijacking Human-in-the-Loop Approval
Sep 17, 2026Adithyan Arun KumarAI Agent Security Runtime Enforcement for AI Agents
Independent Security Researcher
Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)
Aug 24, 2026Avital Aviv, Parth A. Gandh, Ron Bitton +1LLM Agent Security AI Agent Security
Ben-Gurion University of the Negev Beer-Sheva, Israel
aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents
Jul 6, 2026Sai Varun KodathalaAI Agent Security LLM Agent Security
Research & Development SportsVision AI Minnetonka, MN

Sep 17, 2026J/K move · Enter open · S save

Loopjacking: Hijacking Human-in-the-Loop Approval

Adithyan Arun Kumar

Independent Security Researcher

AI Agent Security Runtime Enforcement for AI Agents

Open paper AskPDF arXiv

Human approval is often treated as the last security boundary before an agent executes a consequential operation. That boundary is only meaningful if the operation presented for review is the operation later authorized or released. We call failures of this binding Loopjacking: a human approves what they understand as operation A, while the implementation uses that decision for a materially different operation B. We distinguish two variants. In a representation-based attack, B is already encoded but omitted or misrepresented at approval time; in a post-approval state-substitution attack, the human sees the correct A and mutable workflow state later replaces it with B. We evaluate a purposive set of released agent products. We reproduce post-approval substitution in seven tested Agno AgentOS releases ending at 3.0.9 and in 12 tested versions of a conditional in-memory LangGraph Agent Server composition ending at 0.14.0. We reproduce representation mismatch in OpenClaw 2026.2.23 and its rejection in 2026.2.24. OpenAI Agents SDK 0.22.0 and 0.22.2 provide a negative control: serialized continuation preserves exact per-call binding and rejects mutated B. These results do not estimate ecosystem prevalence. They show that complete canonical approval rendering and exact use-time comparison, or preventing unauthorized pending-state mutation, block the tested attacks while preserving legitimate execution. We separate this contribution from established work on misleading dialogs, session smuggling, action binding, and authorization continuity.

Abstract

AI Agent Security

Explore similar work

Loopjacking: Hijacking Human-in-the-Loop Approval

Beyond the Mandate: A Systematic Security Analysis of the Agent Payments Protocol (AP2)

aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents