AI Security Atlas › All entries › Autonomous Agent & MCP Security
Dual-Agent Approval Loop
A separate verifier agent (or human) must approve high-risk tool plans before the executor proceeds.
Open in the interactive atlas →Impact
Blocks single-pass goal drift and tool hijacking from completing silently.
Why this severity
Guardrails take the highest severity of the risks they mitigate: Agent Tool Hijacking (High), Goal Alignment Drift (High).
Method: OWASP Risk Rating Methodology
Related
Mitigates
- Agent Tool Hijacking Threat · High severity
- Goal Alignment Drift Threat · High severity
Builds on
- MCP Permission Scoping Guardrail · Fixes critical risks
- Verifiable Action Previews for Approvers Guardrail · Fixes medium risks
Remediation
- Route write/admin tools through an approval queue with TTL.
- Use a differently prompted verifier model without tool credentials.
- Escalate unresolved disputes to a human operator.
How to verify
- Simulate hijack plans and confirm executor stalls until approval.
- Measure false-approve rate on a labeled red-team set.
Pattern
const verdict = await verifier.review(plan);
if (verdict !== 'ALLOW') return hold(plan);Framework mapping
OWASP Top 10 for LLM Applications 2025
- LLM06:2025 Excessive Agency
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI09:2026 Human-Agent Trust Exploitation
MITRE ATLAS
- AML.M0029 Human In-the-Loop for AI Agent Actions
NIST AI RMF 1.0
- MANAGE 2.4 Mechanisms exist to supersede, disengage, or deactivate AI systems