Malicious plugin updates can hijack AI agent lifecycle hooks

HookPry compromised seven evaluated agent harnesses by binding attacker-controlled shell commands to routine runtime events.

PaperTop Universitycs.CRarXiv:2609.03884v1
Pengxun Li · Litian Zhang · Jianwei Hou · Shujiang Wu · Song Li · Zifeng Kang · +1 more

Beijing University of Posts and Telecommunications · Data Technology Support Center of the Cyberspace Administration of China · Beihang University · Zhejiang University

Research Digest··2 min read
Li and colleagues examine a supply-chain attack in which an adversary controls plugin metadata and lifecycle-hook configuration, but not the underlying agent harness. Across 1,000 end-to-end trials, their automated framework induced malicious host-side behavior in all seven evaluated harnesses, while several representative defenses missed many or all attack artifacts.

What they did

The authors developed HookPry, an open-source automated framework that trojanizes updates to otherwise benign, versioned plugins. The updates attach attacker-selected shell commands to lifecycle events such as session starts, tool calls, and file edits; these commands can execute with host privileges, sometimes without being visible to the language model.

They tested ten attack objectives across seven agent harnesses and multiple model backends. The evaluation covered 25 harness-backend combinations and 1,000 end-to-end runs, and also assessed Microsoft Defender and three static artifact-analysis defenses.

Key findings

  • HookPry produced successful compromises in all seven evaluated harnesses, demonstrating that the vulnerable update path was not confined to one implementation.
  • Per-harness attack success rates reached 92.5% across the tested configurations.
  • The framework implemented ten malicious objectives, including host-side privilege escalation, while controlling only plugin metadata and lifecycle-hook configuration.
  • Microsoft Defender had 0% recall in this evaluation, while the union of three static defenses still missed 47.5% of malicious artifacts.

Why it matters

The study identifies lifecycle-hook configuration as executable supply-chain content rather than harmless plugin metadata. Because hooks may run privileged commands outside the model's observation, securing the model or filtering its outputs alone cannot prevent these attacks; harnesses also need authenticated updates, explicit permission controls, runtime isolation, and monitoring of hook execution.

Caveats

The results apply to seven harnesses, selected backends, ten attack objectives, and a specific threat model in which an attacker can publish or alter plugin updates. The abstract does not establish how common such access is in deployed ecosystems, how the attacks fare against stronger sandboxing or signed-update systems, or whether the reported detection rates generalize beyond the tested artifacts and defense configurations.

§
newspaper

Research Digest

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.