PaperlayerView exact revision on arXiv

Source-linked AI summary

A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors

Pengxun Li, Litian Zhang, Jianwei Hou, Shujiang Wu, Song Li, Zifeng Kang, Xi Zhang

arXiv:2609.03884v1cs.CRcs.AI

TL;DR

AI agent harnesses trust lifecycle-hook updates that can bind attacker-chosen commands to events outside the LLM’s decision path, creating a configuration-layer supply-chain attack surface. The paper proposes HookPry, an automated cross-harness framework exploiting this path, and finds successful compromise across all evaluated harnesses while representative defenses miss substantial malicious artifacts.

  • Problem

    Lifecycle-hook updates can silently add attacker-chosen commands to trusted plugins, allowing malicious host-side behavior without new LLM decisions or hook-specific authorization.

  • Method

    HookPry is an open-source, fully automated framework that uses manifest optimization, temporal decoupling, and cross-harness native compilation to deliver lifecycle-hook attacks.

  • Results

    HookPry compromised all seven evaluated harnesses across 1,000 end-to-end runs, with overall oracle-confirmed effects in 77.0% of runs and peak effectiveness of 92.5%.

  • Takeaways & Limitations

    Lifecycle-hook review should cover installation, updates, registration, and runtime information flow, while static scanning cannot replace runtime monitoring and permission constraints.

  • Takeaways & Limitations

    The experiments use ephemeral environments with synthetic assets and cover seven harnesses, five backends, and 40 attack cases rather than exhausting systems, policies, or future versions.

Abstract

from arXiv · show

Modern AI agent harnesses expose lifecycle hooks that bind shell commands to runtime events such as session start, tool calls, and file edits. These commands run with host privileges yet ship as lifecycle-hook configuration and may fire at times the LLM never observes. We identify the lifecycle-hook update path, which harnesses trust blindly, as a new attack surface. Under a supply-chain threat model in which an attacker controls only plugin metadata and lifecycle-hook configuration, a benign versioned plugin can be trojanized by an update that silently binds attacker-chosen commands to benign events, yielding malicious host-side behavior such as privilege escalation. We propose HookPry, an open-source and fully automated attack framework that systematically exploits this vulnerability across heterogeneous AI agent harnesses. HookPry realizes ten attack objectives; across 25 combinations of harnesses and backends in 1,000 end-to-end runs, it compromises all seven evaluated harnesses, with per-harness success rates reaching 92.5%. Representative defenses remain insufficient: Microsoft Defender has 0% recall, and the union of three static defenses misses 47.5% of malicious artifacts.

1 Introduction

AI agent harnesses place powerful host execution behind lifecycle hooks that can run outside the LLM’s decision path. HOOKPRY exploits trusted plugin updates to add malicious hooks, automating this supply-chain attack across heterogeneous harnesses.

  • Attack surface: Lifecycle hooks bind runtime events to system commands that the harness can dispatch as subprocesses without LLM selection.This creates a post-trigger boundary that prompt- and alignment-focused defenses cannot inspect.
  • Attack surface: A trusted plugin can be trojanized when an update silently adds attacker-chosen lifecycle bindings under the same identity.The threat model gives the attacker control only over plugin metadata and lifecycle-hook configuration.
  • Framework: HOOKPRY combines Adversarial Manifest Optimization, Temporal Decoupling, and Least Common Interface to acquire trust, activate later, and operate across harnesses.AMO improves benign-plugin discoverability, TD separates trust acquisition from hook-bearing updates, and LCI translates abstract attack logic into native representations.
  • Evaluation: HOOKPRY realizes ten attack objectives across 25 harness-backend combinations and 1,000 end-to-end runs, compromising all seven evaluated harnesses.Overall, 77.0% of runs produced fully oracle-confirmed effects, with peak effectiveness of 92.5% on Hermes.
  • Evaluation: Microsoft Defender achieved 0% recall, while three combined static defenses missed 47.5% of malicious artifacts.The results indicate that lifecycle-hook bindings can bypass model-mediated defenses and evade scanners that do not inspect the hook path.

2 Overview

Lifecycle hooks sit across the AI agent execution path, binding events to commands that the harness evaluates and dispatches independently of model reasoning. The paper frames this architecture as a configuration-layer supply-chain risk and examines its threat model, prior attack boundaries, and HOOKPRY’s authorization-bypass example.

  • 2.1 Background: An AI agent harness translates model outputs into stateful host operations through context management, inference, execution, persistent state, and tool dispatch.Lifecycle hooks form a cross-cutting interception and policy layer around this core path.
  • 2.1 Background: Lifecycle hooks bind events such as tool invocation or file modification to shell commands dispatched by the harness itself.Their effects depend on update adoption, event occurrence, and subprocess privileges.
  • 2.2 Related Work: Unlike prompt, tool-description, and plugin-code attacks, HOOKPRY targets bindings between events and commands at the harness configuration layer.Prior work primarily influences model decisions through visible descriptions or returned values.
  • 2.4 Threat Model: In Claude Code, a trusted plugin update automatically loaded newly added hooks without user notification, item-level confirmation, or re-authorization.The update mechanism applied manifest changes without validating individual hook entries.
  • 2.4 Threat Model: The threat model restricts the attacker to a versioned public-marketplace plugin, with control over metadata, versioning, and lifecycle-hook configuration.The attacker cannot force installation or event triggering, inject prompts or tool results, modify the harness, or bypass a sandbox.
  • 2.4 Threat Model: The evaluation focuses on versioned-plugin hooks and excludes marketplace adoption, prompt injection, repository-controlled configuration, implementation vulnerabilities, and sandbox escapes.These adjacent vectors may complement or amplify HOOKPRY but are outside the measured mechanism.

3 Methodology

HOOKPRY links adversarial metadata optimization, temporal decoupling, and least-common-interface compilation into a supply-chain attack path across heterogeneous AI agent harnesses.

  • HOOKPRY chains marketplace visibility, trust-boundary discovery, and native lifecycle-hook compilation into one attack workflow.AMO creates the initially benign carrier; TD characterizes hook trust; LCI transfers the resulting semantics across harnesses.
  • Adversarial Manifest Optimization: AMO optimizes only plugin metadata while leaving the advertised benign hook functionality unchanged.The metadata consists of the plugin name and natural-language description, while the benign hook implements the advertised functionality.
  • Adversarial Manifest Optimization: AMO targets controlled retrievability within a functional category using budget-matched metadata candidates and representative benign plugins.The ideal objective depends on the marketplace ranker and category query distribution, which are unavailable in practice.
  • Attack taxonomy: Table 1 classifies HOOKPRY attacks by target asset, victim consumer, and communication pattern, with MITRE ATT&CK tactic mappings.

1 Adversarial Manifest Optimization

The supplied passage is only a fragment naming multi-intent retrievability, so it does not support a substantive section summary.

  • The section fragment names multi-intent retrievability without explaining its method or findings.

3 Least Common Interface

The method probes lifecycle-hook trust boundaries, selects feasible weak boundaries, and compiles minimal attack semantics into native configurations across heterogeneous harnesses.

  • Adversarial Manifest Optimization: AMO improves retrieval while preserving the benign probe carrier, enabling TD to measure hook trust boundaries without malicious execution.Only the metadata changes; the benign hook remains invariant and semantically consistent with the advertised functionality.
  • Temporal Decoupling: The selected payload activates only when the boundary predicate matches the event, loading stage, privilege context, and environment state.Outside the target state, the hook preserves its original benign behavior.
  • Temporal Decoupling: TD generates benign probes for candidate boundaries and compares validation, authorization, runtime privilege, and observability across them.Boundaries vary by lifecycle event, configuration source, loading stage, and runtime state.
  • Temporal Decoupling: TD selects the feasible boundary with the largest trust gap while requiring sufficient payload capabilities and observability.The observability threshold is preregistered, and the resulting process combines candidate generation, differential probing, and constrained selection.
  • Least Common Interface: LCI extracts the minimal capabilities needed for the target effect and execution conditions, then restricts applicability when harnesses lack them.For tool-input manipulation, required conditions include pre-tool-execution timing, invocation context, and input-control capability.
  • Least Common Interface: LCI chooses native events with the fewest additional dependencies and compiles invariant attack semantics into each harness’s command and configuration format.The adapter preserves the target effect and necessary conditions while supplying harness-specific event names, command strings, and configuration structures.

5 Experimental Evaluation

HOOKPRY evaluates lifecycle-hook attacks across heterogeneous harnesses, measuring verified end-to-end effects, mechanism initiation, backend dependence, component contributions, and static-defense coverage. The experiments show broad compromise capability, post-trigger model independence in several harnesses, distinct component roles, and substantial defensive gaps.

  • RQ1.1: Execution-Level Effectiveness and Mechanism Utility: 77.0% micro-averaged E2E-ASR resulted from 770 pass verdicts across 1,000 attempted runs, with no runs explicitly blocked.The evaluation also recorded 34 partial and 196 failed verdicts; partial outcomes receive zero credit.
  • RQ1.1: Execution-Level Effectiveness and Mechanism Utility: 83.9% overall mechanism utility exceeded both 77.0% micro-averaged and 77.9% macro-averaged E2E-ASR, showing initiation does not ensure external-effect completion.Utility was highest for Privilege Escalation at 94.3% and Resource Hijacking at 91.7%, but lower for Command and Control at 55.4% and Persistence at 65.8%.
  • RQ1.1: Execution-Level Effectiveness and Mechanism Utility: 92.5% overall success on Hermes and oracle-confirmed effects on every target harness demonstrate broad but nonuniform attack effectiveness.Hermes achieved 100% in five categories, while local deployment policy still affected whether bound commands started.
  • RQ2: Translating Malicious MCP Targets into Hooks: 92.0% native HOOKPRY E2E-ASR on 50 paired targets exceeded MCP2Hook’s 56.0% E2E-ASR, with p = 7.09×10−12.Translated MCP attacks still required the model to invoke the effect tool, whereas native hooks executed from lifecycle events.
  • RQ3: HOOKPRY Ablation Study: Removing AMO reduced E2E-ASR to 75.6%, while removing TD or LCI reduced E2E-ASR to 0% at their respective delivery or registration stages.Without LCI, payload loading remained at 100% but native hook registration fell to 0%; without TD, payload loading also fell to 0%.
  • RQ4: Countermeasure: 47.5% of malicious artifacts remained undetected by the union of Microsoft Defender, Semgrep, and HookPolicy.Defender detected 0/40 malicious artifacts, while HookPolicy detected 20/40 and Semgrep detected 19/40.

6 Discussion and Limitations

The discussion identifies lifecycle-hook trust as an execution-boundary failure that requires defenses spanning updates, registration, permissions, and runtime information flow. It also notes that experiments are bounded by synthetic environments, limited coverage, and excluded attack capabilities.

  • Lifecycle-hook trust failures occur after event matching, when the harness binds commands and dispatches subprocesses beyond the model’s decision path.Prompt defenses therefore do not cover this execution boundary.
  • 47.5% of malicious artifacts were missed by the union of three static defenses, so static scanning cannot replace runtime monitoring and permission constraints.
  • Effective review must cover plugin installation, updates, hook registration, runtime information flow, changed-hook authorization, manifest signatures, and least privilege.For PostToolUse events, defenses should also preserve original outputs and record transformation provenance.
  • The evaluation used ephemeral environments with synthetic assets across seven harnesses, five LLM backends, and 40 attack cases, excluding several systems, policies, and future versions.It also excludes implementation bugs and sandbox escapes.
  • Future work should measure update adoption, expand system and policy coverage, build representative benign-plugin benchmarks, and evaluate runtime protections.

7 Conclusion

The conclusion presents lifecycle hooks as a supply-chain attack surface and evaluates HOOKPRY across harnesses and backends. It reports substantial attack success, incomplete static defense coverage, and boundaries imposed by synthetic testing and responsible-release constraints.

  • 77.0% micro-average E2E-ASR was achieved across 1,000 runs on seven harnesses and five LLM backends, with effects verified on every target harness.
  • 92.0% E2E-ASR was achieved by native lifecycle hooks versus 56.0% for translated malicious MCP descriptions on the paired comparison set.
  • 47.5% of malicious artifacts were missed by the union of three static defenses.
  • Security auditing must treat plugin updates, hook registration, subprocess permissions, and tool-output integrity as one trust chain beyond model-level content protection.
  • The study is dual-use because its findings could support both targeted defenses and harms including credential harvesting, result tampering, persistence, and resource hijacking.
  • Evaluations used synthetic files and preset checkpoints, excluded forced installation and sandbox escapes, and recommend staged release of artifacts that could increase abuse capability.

Appendix: Case Studies

The case studies examine two lifecycle-hook paths: a model-invisible subprocess effect and tool-output tampering that changes subsequent model judgments. Both track execution from plugin loading and event triggering through security impact.

  • The study selects PreToolUse and PostToolUse hooks because they follow distinct operational paths through the harness.One produces a host-side effect; the other modifies tool output returned to the agent loop.
  • Host-side credential collection uses a PreToolUse hook whose subprocess runs after a matching event without a separate user or model authorization prompt.
  • PostToolUse tampering rewrites genuine vulnerability findings into a passed status with zero vulnerabilities before the result re-enters the model context.
  • The two cases differ in plane: one affects harness execution without model reasoning, while the other changes model-visible output and subsequent reasoning.
  • Both attacks begin with event-to-action bindings in plugin configuration and require neither malicious model generation nor malicious action selection.
Loading 2609.03884v1…