# Approve What, Exactly: four agent frameworks run unapproved arguments

> An approval counts as a second factor only when the action that runs is the exact action the user saw and agreed to, the paper argues.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Attack
- **Published by:** arXiv
- **Disclosed:** 2026-10-15
- **Affects:** LangGraph, Agno, Pydantic AI, CrewAI, MCP Python SDK
- **Research by:** Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill
- **Primary source:** https://arxiv.org/abs/2610.21063
- **Page:** https://theinjection.dev/items/arxiv-agent-step-up-effect-binding/

LangGraph, Agno, Pydantic AI and CrewAI can execute tool-call arguments that changed after a user approved them, three authors report in a paper that audited ten agent runtimes and released its test code.

## What happened

Sai Varun Kodathala, Prashanth Pollishetty and Jaylen Cargill posted "Approve What, Exactly?" to arXiv on 15 October 2026. The paper defines twelve attacks on the approval path of AI agents, then audits ten agent runtimes to see whether an approval binds to the action that later runs. The authors report that none of the ten produced an approval record a third party could verify, and they released their gateway, test code and data on GitHub.

## How it works

Effect binding is the property under test: the arguments a user approved should be the only arguments that execute. LangGraph runs whatever arguments sit in thread state when a paused run resumes, and Pydantic AI runs arguments taken from a caller-supplied message history, so a later write can replace an approved call. In CrewAI, a hook that runs after approval can change the arguments an earlier hook checked. The paper names a second problem forged narration: the agent writes the approval card itself, so the text shown to the user can describe one action while another is queued.

## Who is affected

Teams that rely on a human approval step in LangGraph, Agno, Pydantic AI or CrewAI are the audience for this finding, which covers four of the eight audited runtimes whose binding the authors could measure. The authors report that argument substitution in Agno still worked in versions 3.0.9, 3.0.10 and 3.1.3. Claude Code, Codex CLI and Cursor sit outside the audit because the authors did not run them.

## What to do

Treat an approval in these frameworks as a record of what a user intended, not proof of what executed, and keep the policy and authorization checks that already gate the action. The authors argue an approval should be bound to a canonical description of the effect and signed, and they note that no approval design stops an effect that policy already permits.

## Quick facts

- **Affected:** LangGraph, Agno, Pydantic AI, CrewAI: 4 of 8 runtimes with measurable binding
- **Runtimes audited:** OpenAI Agents SDK, LangGraph, Google ADK, Agno, Pydantic AI, CrewAI, AutoGen AgentChat, smolagents, MCP Python SDK, OpenClaw
- **Also tested:** AP2 reference implementation v0.2.0, Microsoft Agent Governance Toolkit, MCP Python SDK 2.3.0 elicitation
- **Attack type:** Post-approval argument substitution, forged approval narration, approval flooding
- **Found by:** Sai Varun Kodathala, Prashanth Pollishetty, Jaylen Cargill
- **Disclosed:** 15 October 2026, arXiv v1
- **Status:** Research paper, no CVE assigned. Code and data released

## Sources

1. [arXiv Paper](https://arxiv.org/abs/2610.21063)
2. [Code And Data](https://github.com/Sports-Vision-Inc/agent-step-up)