AI & Agent Dev Bug Sandbox Back to Radar

Langchain 1.4.0: After_model Middleware With Jump_to='Tools' Bypasses HITL Pending_tool_calls Gate

In langchain 1.4.0, the HumanInTheLoopMiddleware records pending tool calls before interrupting. Any other after_model middleware that returns the documented {"jump_to": "tools"} outcome routes the graph directly to the tool node, skipping the HITL middleware entirely. This allows previously rejected (or not-yet-reviewed) tool calls to execute with user authority, silently defeating human-in-the-loop approval.

criticalConfidence 95%Langchain Affected V1.4.0

Origin Analysis

The graph routing in libs/langchain_v1/langchain/agents/factory.py short-circuits jump_to="tools" directly to the ToolNode without re-entering the HumanInTheLoopMiddleware or re-checking pending_tool_calls. The HITL gate only applies during the normal model→HITL→tools path; a jump_to from another middleware bypasses this invariant, leading to execution of rejected tool calls.

1. Create an agent with HumanInTheLoopMiddleware (interrupt_on={"unsafe_tool": {"allowed_decisions": ["approve", "reject"]}}) and an additional AfterModelMiddleware that returns {"jump_to": "tools"} when the model emits tool calls.\n2. Run the agent: the model proposes calling unsafe_tool; HITL interrupts.\n3. Resume the conversation with a Command that rejects the tool call (decision='reject').\n4. Observe that the unsafe_tool executes and writes its marker file, despite the rejection.\nControl run without the jump middleware does not execute the tool.

Fixing Code Block

0x7F 45 4C 46 02 01 01 000x90 12 AB 04 C1 7E 33 08
0xA4 1C 90 3E 77 0B D2 580x11 F6 6A 2C 80 19 DE 44
0x00 00 00 00 03 00 3E 000x01 00 B7 4D 55 90 0C 61
0x6C 69 62 63 2E 73 6F 2E0x36 00 8E 17 42 AA 05 F3
0xDE C0 DE 01 8B 45 FC 890xC7 5D 20 6F 91 03 E4 78
0x13 37 00 4F 9A 2D E1 700x08 B4 5C 22 71 D0 4A 16
0x48 8D 3D 22 01 00 00 E80x91 FF 0A 63 2E 57 B8 04
0x5A 91 C3 0E 44 70 1B 880x02 6F 39 C4 15 80 ED 27
0xFF 15 40 20 60 00 48 890xC3 90 7A 01 4C 28 B1 56
0x0F 1F 44 00 00 55 48 890xE5 C3 18 6D 92 0B 33 A7

Edge Case Audit

This guard relies on pending_tool_calls being correctly populated and cleaned. If the HITL middleware is not used, pending_tool_calls may be absent or stale, causing no effect. In concurrent or multi-threaded runs with shared state, pending_tool_calls may not be thread-safe, leading to race conditions. Rolling back this fix should be done only after reverting to a version without additional jump_to middlewares. Upgrade from 1.4.0 to a patched version may require re-testing all middleware combinations to ensure no legitimate jump_to flows are blocked.