In Brief
- Lies-in-the-Loop (LITL), publicly disclosed by Checkmarx in September 2025 and now cataloged by OWASP as HITL Dialog Forging, turns the safeguard into the exploit vector: a compromised agent narrates a benign approval dialog while a different action executes.
- A June 2026 arXiv preprint (not yet peer-reviewed) names the missing property consent integrity and imports it from hardware-wallet clear-signing: the dialog is rendered from the real action, and approval binds to a hash of that action.
- The mediator’s security argument rests on total mediation, which the paper assumes rather than delivers; any unmediated path to a side effect is a path the dialog never sees.
- The same trust list that silently passes 10% of abuse commands marks 87% of ordinary commands uninspectable, and an independent preprint from the same month models a fatiguing reviewer and finds that escalating every decision to one is less safe than escalating most of them.
- Meta’s May–June 2026 Instagram incident — up to 20,225 potentially affected accounts, a figure it cautioned could be smaller and may include accounts reached by their legitimate owners — is a cousin in the same failure family: an identity-binding gap, not the action-binding gap the paper formalizes.
Why This Matters
The approval dialog is the last gate between an autonomous coding agent and a destructive action. If the agent narrates that dialog, the gate is only as trustworthy as the agent it exists to constrain. Teams already spend on two adjacent defenses: hardening what the agent reads, and tuning how accurately the gate decides. Consent integrity is orthogonal to both. It asks whether the thing the human approved is provably the thing that ran. Until that is answered, the human is scoring the agent’s story rather than its action, and so is any gate that reads the agent’s rendering rather than the resolved call.
Key Findings
1. The approval dialog has an unsigned trust path
The structural claim is simple, and obvious once stated. The June 2026 preprint What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents (Xiaoqi Weng, Bournemouth University) is an arXiv formalization, not yet peer-reviewed. It opens on the claim directly: “Coding agents gate consequential actions behind a human-in-the-loop approval dialog, but the dialog is narrated by the agent itself” (arXiv 2606.02668).
The human approves a summary the agent wrote. If the agent is compromised — by prompt injection, by a poisoned tool description, by a malicious skill — the summary it writes and the action it runs are two independent strings. Nothing enforces a relationship between them.
This is not a hypothetical the paper invented to justify a defense. The attack was disclosed in the field first. Checkmarx Zero published the Lies-in-the-Loop technique in September 2025, with follow-up coverage later that year, demonstrating dialog manipulation against Claude Code and a Markdown-sanitization failure in Microsoft Copilot Chat (Checkmarx, Checkmarx follow-up).
OWASP now catalogs it as HITL Dialog Forging and lists three techniques (OWASP). Dialog padding prepends and appends benign text to push the dangerous command out of the visible window. Markdown/HTML injection restructures the dialog so attacker content mimics legitimate UI. Action-descriptor tampering edits the summary metadata that describes what the agent intends to do.
The Copilot variant is the sharpest illustration of where this goes, though the sharp end is projected rather than reached. Per Checkmarx’s analysis, Copilot Chat in VS Code failed to sanitize Markdown in the dialog — but in the proof of concept the injection arrived by direct prompting and the Markdown rendered only after the user had already answered, a case Checkmarx explicitly labels as carrying “no additional risk.”
The escalation it describes is conditional: if attackers can land the injection through indirect prompt injection so that it renders before the response, they could close the code block holding the malicious command early, pad with explanatory prose, and open a fresh block showing a benign command. That would be a fabricated UI rendered inside the trusted surface. Checkmarx’s own guess is that “an agent that does precisely this either already exists or will in the future” — which is a prediction about the attack surface, not a report of it.
The approval channel therefore inherits the security properties of whatever renders it. When the renderer is the agent, the channel has no independent consent-integrity property.
2. Consent integrity is clear-signing for agents
The defense the paper proposes is named Consent Integrity, and its definition is the central sentence. A system provides it if “the human is shown R(A), a representation of A’s security-relevant semantics computed by the trusted mediator from A itself, not from any agent narration” (arXiv 2606.02668).
The mechanism is a Consent-Integrity Mediator (CIM) that sits at the action boundary, intercepts the real action, and renders the dialog from the action’s actual semantics. The agent’s own summary is demoted to clearly-labeled untrusted text alongside the trusted rendering.
Practitioners who have touched hardware wallets will recognize this immediately, because it is the same property under a different name. Clear-signing is the “What You See Is What You Sign” (WYSIWYS) principle the Ethereum Foundation’s security effort is standardizing against blind-signing. It works because the transaction details travel from the secure element to the device’s own screen without passing through the potentially-compromised host (Ledger, OneKey on the Ethereum clear-signing standard). Even if your laptop is owned, the truth appears on hardware the malware does not control.
The paper imports WYSIWYS and the trusted-path property into the agent approval channel by name. That lineage is the thing to carry out of this work. Consent integrity is not a novel cryptographic invention; it is a well-understood property from transaction signing, applied to a surface that currently lacks it.
CIM’s analyzer (the paper calls it D) is what computes the rendering. It strips padding and no-ops, recursively peels obfuscation (base64, hex, command substitution), and extracts security-relevant facts: network egress, credential reads, privilege escalation, out-of-workspace writes. It inspects referenced script bodies when the agent invokes an interpreter. And it flags anything it cannot positively classify as uninspectable rather than silently approving it. Default-deny on ambiguity is the design posture.
3. The trusted mediator only works if it sees everything — and that is the hard part
Two design properties carry the security argument, and both are where production reality will bite.
The first is bind-to-execution, the defense against the time-of-check/time-of-use gap. Approval binds to the canonical hash of the exact action; any execution that does not match the approved hash is refused (arXiv 2606.02668). This closes the window where an agent gets approval for action A and then runs a mutated A′.
TOCTOU is not a niche concern here. A separate arXiv paper, Atomicity for Agents (Jiang, Liu, Luo, Lin), exposes a neighbouring temporal gap in browser-use agents. There, the page state an agent planned against can mutate before the planned click lands (arXiv 2603.00476). The two gaps take different answers. A hash of the concrete action catches an approved action swapped for a different one; it does nothing for an unchanged action whose target has moved underneath it, which is why that paper’s own mitigation validates the page state immediately before execution rather than binding the action.
The second property is total mediation, and the paper is honest that it is the central assumption rather than a delivered guarantee. The threat model assumes the adversary “does not control the mediator process, the action-boundary interception that ensures the agent has no un-mediated path to a consequential action, or the trusted-path channel over which approvals are displayed and answered” (arXiv 2606.02668).
If the agent has any unmediated path to a side effect, the mediator never sees the action and renders nothing. The auto-mode stress-testing literature has been hammering the same lesson. A gate only governs the actions that route through it, and agents are resourceful about finding paths that don’t. A consent-integrity mediator that an agent can route around is a clear-signing display wired to the wrong bus.
4. The same trust list that stops silent passes drives the over-prompting
The paper’s evaluation surfaces the central tension of the whole approach, and the exact numbers matter. Against GTFOBins, a corpus of 1,330 trusted-tool-abuse commands, the mediator flags 90.0% (405 by an explicit danger fact, 792 as uninspectable) and silently passes 10.0%. Against tldr, a corpus of 28,798 normal-usage commands, it prompts on 95.9%, marks 87.0% uninspectable, and lets only 4.1% pass without a prompt (arXiv 2606.02668).
| Corpus | Commands | Flagged / prompted | Uninspectable | Silent pass |
|---|---|---|---|---|
| GTFOBins (trusted-tool abuse) | 1,330 | 90.0% flagged (405 of them by an explicit danger fact) | 792 of 1,330 (59.5%) | 10.0% |
| tldr (normal usage) | 28,798 | 95.9% prompted | 87.0% | 4.1% |
On a controlled 22-case LITL set it fully explained 17, safely flagged 5, and allowed 0 silent passes, with 0/10 false positives on benign workflows and 3/3 TOCTOU swaps prevented.
The paper does not offer those as independent evidence: “The clean numbers on the controlled set are co-design artifacts: the same author wrote both the analyzer and that corpus,” and it says of the 10.0% GTFOBins silent-pass rate that “that figure, not the controlled zero, is the one to trust” (arXiv 2606.02668). Analyzer overhead was negligible: a mean of 0.056 ms (n=4,000). That is the implemented component only; the paper is explicit that the figure “excludes total mediation and trusted-path rendering, which the prototype does not implement and which would dominate any end-to-end figure” (arXiv 2606.02668).
The relationship between the two corpora is the finding. The paper states it plainly: shrinking the trust list toward pure default-deny “drives silent passes toward zero but pushes the uninspectable rate on normal usage toward 100%, which is approval fatigue by another name” (arXiv 2606.02668). The same conservatism that suppresses the 10% silent-pass rate on abuse commands is what generates the 87% uninspectable rate on ordinary ones. Consent integrity does not dissolve the safety/usability frontier; it relocates the dial and makes the tradeoff legible.
A companion line of work, Oversight Has a Capacity (Emre Turan, arXiv 2606.08919), models the human reviewer as a fatiguing, finite resource. It finds an inverted-U: escalating every decision is less safe than escalating most of them, because a reviewer drowning in prompts rubber-stamps. In the paper’s simulations, full escalation produced higher danger-through rates than a calibrated sub-total escalation rate across every capacity level tested.
The interaction with consent integrity is direct. A mediator that correctly renders 87% of normal commands as “uninspectable” is correct on the integrity axis. It is counterproductive on the fatigue axis, because a human shown that many flags stops reading them. Getting the rendering honest is necessary but not sufficient; the rendering also has to be sparse enough that the human still attends to it.
5. The Meta incident is the right cautionary tale told the wrong way
The Meta breach disclosed in June 2026 — Meta’s own notification dates discovery of the exploitation to 31 May — is the production event most likely to get attached to this paper, and the attachment needs care.
Hackers took over high-profile Instagram accounts. Meta’s breach notification to Maine’s Attorney General put the number of potentially affected accounts at 20,225, a figure Meta’s associate general counsel indicated could actually be smaller and that may include some accounts accessed by their legitimate owners rather than hackers. The takeovers surfaced through late May, and the reported set included the Obama White House account, Sephora, and the account of the Chief Master Sergeant of the Space Force (SecurityWeek, 404 Media, TechCrunch). The Obama White House entry is the contested one: TechCrunch describes that dormant account as having only appeared to be a victim, and records that Meta disputed it (TechCrunch, 3 June).
The route was Meta’s AI-powered account-recovery support assistant. Per a step-by-step video a hacker posted to X, the attacker allegedly used a VPN to spoof the victim’s location, then asked the bot to add an attacker-controlled email to the target account. The video then shows the verification loop completed with a code sent to that same email, and a “Reset Password” button offered up.
The tempting framing — “a live instance of the approval-dialog-narration attack” — overstates it. Per Meta’s own account, the failure was in a separate code path of its High Touch Support tooling that “did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account” (SecurityWeek).
That is a missing binding between the requester and the account’s verified email. It is a guardrail-bypass and a confused-deputy problem, not the approved-summary-versus-executed-action gap the consent-integrity work formalizes. Both failures do live in the same family. A human, or a human-facing system, authorized something on the basis of a representation that was never bound to the underlying reality. Meta’s was an identity-binding failure; LITL is an action-binding failure.
Treating the Instagram breach as proof of the paper’s exact mechanism would be a citation that does not hold up under scrutiny. Treating it as evidence that binding gaps in agent-mediated approval flows are already being exploited in production is accurate, and is the more useful lesson anyway.
6. This is distinct from guidance injection and from classifier accuracy
Consent integrity deserves its own budget line because it is orthogonal to the two defenses teams are likeliest to already have in flight.
Guidance-injection hardening targets the input surface: the CLAUDE.md, AGENTS.md, SKILL.md, and tool-description channels an agent trusts implicitly. That work reduces the probability the agent is subverted in the first place. It does nothing once the agent is subverted; a compromised agent writes an honest-looking summary regardless of how its instructions got poisoned. Consent integrity assumes the agent is already compromised and asks a different question: can it lie in the dialog? The two compose; neither substitutes for the other.
Permission-classifier work targets decision accuracy: given an action, how reliably does the gate label it dangerous? That is a real and hard problem, and the auto-mode stress-test literature shows the gates leak under adversarial load. The study itself cautions that its adversarial numbers are not comparable with Anthropic’s production-traffic measurement, and that the comparison “illustrates workload sensitivity, not a flaw in Anthropic’s measurement.” But scoring presumes the scorer reads the real action, and LITL breaks that presumption for the human, who sees only what the agent wrote.
Whether it breaks it for the classifier depends on the harness. A gate that scores the agent’s rendering of an action inherits the lie. A gate that reads the resolved call directly does not, and its limit is coverage rather than narration: the side-effect paths that never reach it at all.
Consent integrity is the property that makes human approval meaningful, by guaranteeing the person is shown the thing that will actually run — and it does the same for any classifier that scores the agent’s rendering rather than the action itself. In layering terms: guidance-injection defense reduces compromise probability, the trusted-mediator rendering establishes what is being approved, and the classifier scores the action. Skip the middle layer and the human is approving agent-supplied fiction.
Practical Implications
1. Treat the approval dialog as an untrusted surface unless the renderer is independent of the agent
Start with one configuration question: who computes the text in the approval prompt?
If the answer is “the agent,” the dialog provides the feeling of oversight without the property. For any agent acting on production-adjacent surfaces, the rendering of what-will-execute should come from a component the agent cannot author — minimally, surface the concrete action (the literal command, the literal API call with resolved arguments, the literal file path) alongside or instead of the agent’s prose summary. “Show the bytes, not the story” is the deployable version of consent integrity even before a full mediator exists.
2. Bind approval to the concrete action, not to a turn or a description
Where your harness supports it, make approval bind to a hash or canonical form of the exact action. Refuse execution of anything that does not match what was approved. That closes the substitution window the CIM bind-to-execution design targets.
It does not close the environment-state window Atomicity for Agents studies, where the action is unchanged and the world it acts on is not; for that, revalidate the preconditions — DOM and layout, object version, resolved path — immediately before use. An approval that authorizes “the next tool call” or “this described intent” rather than “this exact resolved action” is re-exploitable by any mutation between check and use.
3. Audit for unmediated side-effect paths before trusting any mediator
A consent-integrity mediator is worth exactly as much as its total-mediation assumption holds. Before relying on one, enumerate every path by which the agent can produce a side effect: shell, network, file writes, MCP tool invocations. Pay special attention to the file-edit path, which the auto-mode stress tests showed bypasses classifiers entirely. Any path that does not route through the mediator is a path where the dialog renders nothing and the integrity property silently lapses.
This audit is the same credential-and-surface enumeration that production-grade agent deployments already owe themselves. Consent integrity just adds “and does the approval renderer see this path?” to the checklist.
4. Budget for the over-prompting, or the integrity gain evaporates into fatigue
An honest mediator that flags 87% of normal commands as uninspectable will train reviewers to rubber-stamp unless something else absorbs the volume. The Oversight Has a Capacity model predicts the failure mode: too many honest flags is its own security bug.
Pair any consent-integrity rollout with a story for keeping the human’s attention budget intact. Narrow the trust list to the actual workload, batch low-risk renderings, or route the high-volume uninspectable class to an automated second-stage analyzer. Then the human only sees what genuinely needs a human. Rendering honesty and prompt sparsity are both required; either alone fails.
5. Don’t let vendor risk-acceptance set your threat model
Per Checkmarx’s disclosure timelines, both vendors that received LITL reports declined to treat them as vulnerabilities. Anthropic classified the report — which Checkmarx dates to 28 August 2025 (Checkmarx follow-up) — as “Informative,” with the position that users are responsible for “carefully reviewing all permission prompts (including scrolling up to see the entire prompt) before accepting them” (Checkmarx).
Microsoft, per Checkmarx, marked its October 2025 report “Completed without fixing,” determining the behavior “does not meet our classification for a security vulnerability” and invoking a “Workplace Trust” assumption (Checkmarx follow-up). Those are defensible product decisions about where a vendor draws its support boundary. They are not a risk assessment for your deployment. If your agents read attacker-influenced content (issues, PRs, web pages, pulled documents) and act on production-adjacent surfaces, “the user should have scrolled up” is not a control you can build on.
Open Questions
-
Does total mediation hold in real harnesses? CIM’s security argument rests on the agent having no unmediated path to a side effect, but the prototype specifies rather than enforces that. A production harness would have to route every side-effect path (shell, network, file writes, MCP tools) through a single mediation point. The file-edit and MCP surfaces have repeatedly proven to be the bypass. AEGIS interposes one pre-execution checkpoint on the tool path across 14 agent frameworks (arXiv 2603.12621), but covering the tool path does not prove there is no other route. Whether that routing is achievable determines whether this is a deployable property or a whiteboard one.
-
Who renders the action, and where does it run? Hardware-wallet clear-signing works because the renderer is physically separate from the compromised host. The agent equivalent has no obvious hardware boundary. Can the trusted renderer live in the same process as a potentially-compromised harness, or does it need a genuine isolation boundary (a separate process, a separate sandbox, a separate machine)? That is unresolved and central to the security claim.
-
Can the uninspectable rate come down without weakening the property? An 87% uninspectable rate on normal usage is a usability cliff. The frontier the paper names — trust-list size trades silent passes against over-prompting — may be improvable with better analyzers (richer static analysis, learned classifiers that fail safe). But no one has shown the curve can be bent rather than slid along. If it can’t, consent integrity is a control for high-stakes surfaces only, not a default.
-
Does the standardization path run through MCP? MCP’s elicitation mechanism already wrestles with adjacent concerns: clients are advised to clearly display which server is requesting confirmation, and to make the destination URL visible so the user can examine it. Consent integrity could be specified as a protocol-level property (a signed, mediator-rendered action representation in the elicitation/approval flow) or stay a per-harness implementation detail. Which one happens will determine how portable it is across the ecosystem.
-
What’s the right binding granularity for multi-step plans? Bind-to-execution is clean for a single concrete action. For an approved plan of several actions, binding each step to its own hash re-introduces per-step approval, and the fatigue that comes with it. Binding the plan as a whole re-opens the TOCTOU window between steps. The right granularity for plan-level autonomy with action-level integrity is not yet established.
Sources
- Weng, What You Approve Is What Executes: Consent Integrity for Black-Box LLM Agents (arXiv 2606.02668)
- arXiv abstract page for 2606.02668
- Checkmarx Zero: Bypassing AI Agent Defenses With Lies-In-The-Loop
- Checkmarx Zero: Turning AI Safeguards Into Weapons with HITL Dialog Forging
- OWASP: HITL Dialog Forging (Lies-in-the-Loop)
- Infosecurity Magazine: New “Lies-in-the-Loop” Attack Undermines AI Safety Dialogs
- GBHackers: Lies-in-the-Loop — How AI Safety Dialogs Can Be Exploited for Remote Code Execution
- Turan, Oversight Has a Capacity: Calibrating Agent Guards to a Subjective, Fatiguing Human (arXiv 2606.08919)
- Jiang, Liu, Luo, Lin, Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents (arXiv 2603.00476)
- arXiv: AEGIS — A Pre-Execution Firewall and Audit Layer for AI Agents (2603.12621)
- Ledger: Clear-sign your worries away (WYSIWYS / clear-signing)
- OneKey: Ethereum Foundation’s Clear Signing Standard
- SecurityWeek: Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse
- 404 Media: Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts
- TechCrunch: Hackers hijacked Instagram accounts by tricking Meta AI support chatbot into granting access
- TechCrunch: Instagram is alerting users who were targeted by hackers during AI chatbot attacks
- The HITL approval step in most agentic workflows is broken (raed.dev)
- WorkOS: Understanding URL-mode elicitation in MCP
- Embrace The Red: GitHub Copilot RCE via Prompt Injection (CVE-2025-53773)
- Ji, Li, Jiang, Gao, Wang, Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code’s Auto Mode (arXiv 2604.04978)