What they did
The authors developed HookPry, an open-source automated framework that trojanizes updates to otherwise benign, versioned plugins. The updates attach attacker-selected shell commands to lifecycle events such as session starts, tool calls, and file edits; these commands can execute with host privileges, sometimes without being visible to the language model.
They tested ten attack objectives across seven agent harnesses and multiple model backends. The evaluation covered 25 harness-backend combinations and 1,000 end-to-end runs, and also assessed Microsoft Defender and three static artifact-analysis defenses.
Key findings
- HookPry produced successful compromises in all seven evaluated harnesses, demonstrating that the vulnerable update path was not confined to one implementation.
- Per-harness attack success rates reached 92.5% across the tested configurations.
- The framework implemented ten malicious objectives, including host-side privilege escalation, while controlling only plugin metadata and lifecycle-hook configuration.
- Microsoft Defender had 0% recall in this evaluation, while the union of three static defenses still missed 47.5% of malicious artifacts.
Why it matters
The study identifies lifecycle-hook configuration as executable supply-chain content rather than harmless plugin metadata. Because hooks may run privileged commands outside the model's observation, securing the model or filtering its outputs alone cannot prevent these attacks; harnesses also need authenticated updates, explicit permission controls, runtime isolation, and monitoring of hook execution.
Caveats
The results apply to seven harnesses, selected backends, ten attack objectives, and a specific threat model in which an attacker can publish or alter plugin updates. The abstract does not establish how common such access is in deployed ecosystems, how the attacks fare against stronger sandboxing or signed-update systems, or whether the reported detection rates generalize beyond the tested artifacts and defense configurations.