Modern AI use lifecycle hooks that bind shell commands to runtime events. These commands run with host privileges but are configured through lifecycle-hook updates. The paper identifies the update path as an attack surface: an attacker controlling plugin metadata can silently trojanize a benign plugin by updating its lifecycle hooks to execute attacker-chosen commands when benign events occur.
The authors propose HookPry, an automated attack framework that exploits this vulnerability. It combines adversarial manifest optimization, temporal decoupling, and a least common interface to target multiple harnesses. In 1,000 end-to-end runs across 25 harness-backend combinations, HookPry compromised all seven evaluated harnesses, with per-harness success rates up to 92.5%.
The findings are significant because these attacks are undetected by existing defenses. Microsoft Defender had 0% recall, and a combination of three static defenses missed 47.5% of malicious artifacts. This highlights a critical security gap in AI agent platforms that trust lifecycle-hook updates blindly.