A new AI-focused attack technique, called “Lies-in-the-Loop (LITL),” is raising concerns across the cybersecurity community.
The method targets the very safeguards designed to make AI code assistants safe: Human-in-the-Loop (HITL) confirmation dialogs that request user approval before the AI executes code.
Checkmarx researchers revealed that attackers can secretly manipulate these dialogs to trick users into approving remote code execution (RCE) on their own systems.
How the LITL Attack Works
HITL dialogs are a safety measure widely adopted by AI development tools such as Anthropic’s Claude Code and Microsoft’s Copilot Chat.
When these agents suggest a sensitive command, they present an approval dialog, providing users with transparency and control.
However, the LITL attack subverts this mechanism through HITL Dialog Forging, making malicious commands appear safe or entirely invisible.
Attackers achieve this through prompt injection techniques that manipulate what the AI displays. By padding dialogs with excessive text, they push the harmful command out of sight, or by prepending it with innocuous descriptions.
Some attacks tamper with metadata, such as one-line summaries or command previews, and can rewrite it through indirect prompt injection to further mislead the user.
In advanced forms of the exploit, adversaries combine Markdown injection vulnerabilities, in which unsanitized Markdown is rendered within the interface to modify its display.
This allows attackers to create fake UI components, hide code blocks, or visually alter dialog elements. Once a user “approves” the forged command, their machine executes the hidden malicious payload, enabling potential system compromise.
AI Agent Security at Risk
The implications extend beyond any single platform. HITL dialogs are a recommended mitigation in the OWASP LLM Top 10, addressing LLM01: Prompt Injection and LLM06: Excessive Agency.
The LITL technique effectively undermines this final layer of defense, demonstrating how attackers can exploit user trust as a weapon.
Checkmarx disclosed these vulnerabilities to both Anthropic and Microsoft in 2025. Anthropic classified the issue as “informative,” noting that it falls outside its current threat model. Microsoft acknowledged the Copilot Chat vulnerability but closed the report without a fix.
Researchers recommend a defense-in-depth approach combining strict command validation, metadata integrity checks, and stricter Markdown sanitization. Educating users to recognize forged dialogs is equally vital, as visual deception is central to the LITL method.
Ultimately, the LITL attack redefines AI safety conversations: the very safeguard meant to protect users can become the attacker’s best ally if not adequately secured.
As Checkmarx warns, “Once the HITL dialog itself is compromised, the human safeguard becomes trivially easy to bypass.”
Follow us on Google News , LinkedIn and X to Get More Instant Updates, Set Cyberpress as a Preferred Source in Google.
,” is raising concerns across the cybersecurity.){kind=link}