Loopjacking in A2A Implementations: Hijacking Human-in-the-Loop Approvals
2 days ago
- In a controlled LangGraph Agent Server test, an approval role's decision for a small transfer (20 units) was used to execute a much larger transfer (2,000 units) to an attacker-controlled sink via a same-Task state substitution attack.
- The attack exploited an A2A message/update endpoint where a 'maker' could change the pending operation from A to B using the same task and tool-call IDs, and the later approver's decision was applied to the modified state without verifying the operation scope.
- The tested vulnerability is a form of Loopjacking, where an implementation uses a decision for operation A to release materially different operation B, highlighting the need to bind approval decisions to exact operations rather than task IDs.
- The A2A specification before section 7.6.4 lacked clarity on whether same-Task messages during authorization are implicitly covered by an earlier decision; the clarified spec now assigns responsibility to implementations for defining and checking approval scope.
- The experiment used synthetic identities, a deterministic local model, and an in-memory server, and it controlled for various conditions to isolate the approval-binding failure, including verifying that the maker alone could not execute the transfer.
- The defect was found in LangGraph Agent Server versions 0.7.5 through 0.14.0, and the test showed that a deny-update Auth policy can block the attack by preventing the maker from changing the pending operation.
- The recommended fix involves binding decisions to exact canonical operations, using integrity-protected records and atomic checks at dispatch time to ensure the executed operation matches what was approved.
- Regression testing for A2A approval systems should capture the human-visible operation, decision record, mutable state paths, and sink arguments, and exercise branches like unchanged A, same-Task substitution, and wrong principal/scope.
- The A2A Task ID identifies which work a message is about, but does not answer which exact tool call a human authorized; the approval scope must be explicitly defined by the implementation or credential issuer.
- The evidence archive preserves raw HTTP requests, authorization decisions, ledger events, and package pins for independent verification, supporting a product-specific claim rather than a universal protocol vulnerability.