Hook updates let attackers steer AI agent harnesses

Problem

The paper studies a newly identified supply-chain attack surface in AI agent harnesses: lifecycle hooks. These hooks are manifest entries that bind host shell commands to runtime events such as session start, tool calls and file edits. Hook commands execute with host privileges and can fire at times when the language model does not observe them, creating a post-trigger execution boundary that is invisible to prompt-layer defences. Under a realistic threat model in which an attacker controls only plugin metadata, versioning and hook configuration, a benign, versioned plugin can be trojanised by a later update that silently registers attacker-chosen commands, enabling host-side effects including privilege escalation and data exfiltration.

Approach

The authors build HookPry, an open-source automated framework that realises end-to-end lifecycle-hook attacks across heterogeneous harnesses. HookPry chains three components: Adversarial Manifest Optimisation (AMO) to make an initially benign plugin highly discoverable while preserving benign behaviour; Temporal Decoupling (TD) to separate initial trust acquisition from a later hook-bearing update and to activate payloads only when a chosen runtime trust boundary is reached; and Least Common Interface (LCI) to compile a single abstract attack logic into native hook configurations for multiple target harnesses. The evaluation covers 40 attack cases, seven harnesses and five LLM backends, yielding 25 harness-backend combinations and 1,000 end-to-end runs in ephemeral, synthetic environments. External oracles adjudicate successful host-side effects.

Key Findings

• HookPry compromises all seven evaluated harnesses; across 1,000 runs it produced 770 full passes, 34 partials and 196 fails, giving a micro-averaged verified end-to-end attack success rate of 77.0%. No runs were explicitly blocked by the harnesses.
• Mechanism utility is high: hook-related steps initiated in 83.9% of runs and lifecycle hooks were actually triggered in about 82% of cases; variation in final effect arises from environment and policy constraints after trigger.
• Some harnesses show near model independence after trigger: Codex CLI, OpenClaw and Claude Code have cross-backend standard deviations below 2.5 percentage points, indicating that post-trigger execution is harness-controlled rather than model-mediated.
• Native lifecycle hooks reach 92.0% success on a 50-target paired dataset; mechanically translated malicious tool descriptions converted into hooks achieve 56.0% on the same targets, showing the advantage of direct hook execution over model-mediated tool invocation.
• Representative static defences are inadequate: Microsoft Defender detected 0 of 40 malicious artifacts; two static-rule baselines detected about 47.5 to 50.0% each, and the union of the three still missed 47.5% of malicious samples.

Limitations

Experiments used ephemeral environments with synthetic assets and excluded forced installation, implementation bugs, sandbox escapes and real user data. Success depends on event occurrence, update adoption and hook subprocess privileges. Defence evaluation covered only a small set of static tools and synthetic benign controls; dynamic analysis and broader enterprise policies were not assessed.

Implications

Offensively, an attacker who can publish and later update a marketplace plugin can stealthily install privileged host-side commands that run outside the model’s reasoning loop, enabling credential theft, persistence, manipulation of tool outputs and resource hijacking. The attack is practical across harnesses and evades common static scanners, so adversaries can leverage update-based trust migration to achieve covert, high-privilege effects without exploiting code vulnerabilities or prompting the model to act maliciously.