Security researchers at Checkmarx have exposed a critical vulnerability in AI agent safety mechanisms that transforms Human-in-the-Loop (HITL) dialogs designed as security safeguards into vectors for remote code execution.
The attack, dubbed “Lies-in-the-Loop” (LITL), exploits user trust in approval dialogs by forging their content, effectively turning the last line of defense into a weapon.
The vulnerability affects popular AI code assistants, including Claude Code and Microsoft Copilot Chat, both of which implement HITL dialogs to protect against prompt-injection attacks.
These dialogs are recommended explicitly by OWASP as mitigation for LLM01 (Prompt Injection) and LLM06 (Excessive Agency) vulnerabilities from the OWASP LLM Top 10 list.
Exploiting Trust Dialog Manipulation
The LITL attack manipulates what users see in approval dialogs through indirect prompt injection. By injecting malicious content into external data sources that AI agents process, attackers can forge HITL dialogs that appear benign while concealing dangerous commands.
When the LITL attack is not involved, this is how Claude Code’s HITL dialog looks when it runs in VS Code terminal.
The attack employs multiple sophisticated techniques including padding manipulation, where lengthy benign-looking text pushes malicious payloads above the visible terminal area, and metadata tampering that alters the one-line descriptions summarizing agent actions.
Checkmarx researchers demonstrated the attack against Claude Code, showing how attackers can execute arbitrary commands while users review what appears to be safe operations like bug fixes or repository initialization.
The vulnerability is particularly dangerous for privileged agents like code assistants, which can execute OS commands and typically lack additional safeguards beyond HITL dialogs.
Researchers discovered that Microsoft Copilot Chat fails to properly sanitize Markdown in HITL dialogs, enabling attackers to inject formatted content that can break out of code blocks and present entirely fabricated user interfaces.
This allows attackers to close the code block containing malicious commands prematurely, insert explanatory text to push threats out of view, and open new blocks displaying benign commands.
When Markdown injection is combined with indirect prompt injection, the attack becomes nearly undetectable users review only safe-looking commands while unknowingly authorizing malicious code execution.
The researchers note that terminals with basic ASCII rendering make deception easier compared to feature-rich UI environments that offer stronger visual distinctions.
Mitigations
Checkmarx disclosed the vulnerability to Anthropic in August 2025, which classified both the command injection and HITL dialog forging as “Informative” and outside their current threat model.
 In Claude Code (which runs in the VS Code terminal in my setup), the HITL dialog is distinguished only by a thin 1-pixel border.
Microsoft acknowledged a report in October 2025 but marked it as completed without implementing fixes by November.
Recommended mitigations include implementing stricter input validation, using safe OS APIs that separate commands from arguments, restricting HITL dialog length, and applying Markdown sanitization.
However, researchers emphasize that no silver bullet exists the fundamental issue is that humans can only respond to what agents present, and that presentation can be manipulated through context poisoning.
The discovery underscores growing concerns about AI agent security as these tools gain privileged access to development environments and sensitive systems, requiring defense-in-depth strategies rather than reliance on single safeguard mechanisms.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 dialogs.){kind=link}