A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors
Pengxun Li, Litian Zhang, Jianwei Hou, Shujiang Wu, Song Li, Zifeng Kang, Xi Zhang
cs.CR · cs.AI
Quick verdict
HookPry: hook-update supply-chain attacks compromise all 7 tested agent harnesses (77% E2E-ASR, 1000 runs); oracle-based eval, but AMO ablation is an estimate.
Summary
The paper identifies lifecycle hooks in AI agent harnesses (Claude Code, OpenClaw, Codex CLI, OpenHarness, OpenCode, Hermes, WorkBuddy) as a supply-chain attack surface: harnesses auto-apply plugin updates that add hooks without per-entry re-authorization, dispatching attacker-chosen shell commands outside the LLM's decision path. HookPry operationalizes this with three components: Adversarial Manifest Optimization (marketplace retrievability), Temporal Decoupling (benign first release, then a hook-bearing update with conditional activation), and Least Common Interface (cross-harness compilation), realizing ten ATT&CK-mapped objectives. Across 40 cases × 25 harness–backend combinations (1,000 end-to-end runs) with external oracles, verified E2E attack success is 77.0% (770 passes, zero blocked), peaking at 92.5% on Hermes; mechanism utility is 83.9%. On a paired 50-target set, native hooks reach 92.0% versus 56.0% for translated MCP tool-description attacks (p=7.09×10⁻¹²). Ablations: removing TD or LCI drops success to 0%; the 75.6% w/o-AMO figure is an analytical estimate, not measured. Defender detects 0/40 malicious artifacts, Semgrep 19/40, HookPolicy 20/40, and their union still misses 47.5%. Limitations: synthetic ephemeral environments, no real marketplace adoption measurement, event occurrence driven by experimenter-submitted trigger requests, small per-cell samples without confidence intervals, and vendor disclosure still pending.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- AI agent harnesses apply plugin updates containing new lifecycle hooks without per-entry re-authorization, enabling attacker-chosen subprocess execution outside the LLM's decision path (Fig. 3, §2.3–2.4).
- HookPry achieves 77.0% oracle-verified end-to-end attack success across 1,000 runs over 25 harness-backend combinations, compromising all seven harnesses with a peak of 92.5% on Hermes (Table 2).
- Native lifecycle hooks (92.0%) significantly outperform mechanically translated malicious MCP tool descriptions (56.0%) on the same 50 targets, isolating the model-mediated gate they remove (Table 4, p=7.09×10⁻¹²).
- Representative static defenses are insufficient: Microsoft Defender detects 0/40 malicious artifacts and the union of three static defenses still misses 47.5% (Table 6).
Strengths
Oracle-based end-to-end metric
E2E-ASR requires pre-registered external effects verified by independent oracles; partial outcomes earn zero credit (§4.1), and mechanism utility (83.9%, Table 3) is reported separately from success (77.0%), so mechanism initiation is never conflated with effect.
Well-controlled paired comparison
RQ2 holds targets, fixtures, and oracles fixed while swapping only the delivery mechanism: native hooks 46/50 vs translated MCP descriptions 28/50, with Wilson CIs and an exact binomial test (Table 4), cleanly isolating the removed model-mediated gate.
Breadth with honest negative space
Explicit, reusable formalization
Responsible dual-use handling
Weaknesses
AMO ablation is not measured
Unbalanced design, thin uncertainty reporting
Real-world rates are conditional and unmeasured
Defense evaluation is a soft target
Vulnerability premise awaits vendor confirmation
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper claims a new attack surface: AI agent harnesses (Claude Code, OpenClaw, Codex CLI, OpenHarness, OpenCode, Hermes, WorkBuddy) load lifecycle-hook entries shipped in plugin updates without item-level re-authorization, so a benign, versioned marketplace plugin can be trojanized by an update that binds attacker-chosen shell commands to benign events (§2.3, Fig. 3). The threat model (§2.4) is deliberately narrow: the attacker controls only plugin metadata, versioning, and hook configuration — no prompt injection, no implementation bugs, no forced installation, no sandbox escape. Ten ATT&CK-mapped objectives (Table 1) span credential collection, exfiltration, resource hijacking, C2, tampering, manipulation, privilege escalation, persistence, evasion, and propagation. The central empirical claims: 77.0% micro-averaged oracle-verified E2E-ASR over 1,000 runs (770 pass / 34 partial / 196 fail, zero blocked); per-harness peaks of 92.5% (Hermes) and 90.6–90.8% (OpenCode, WorkBuddy); and insufficient defenses (Defender 0/40; union of three static defenses misses 47.5%).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is HookPry and what does it attack?
HookPry is an automated attack framework presented in this paper that exploits lifecycle hooks in AI coding-agent harnesses (e.g., Claude Code, OpenClaw, Codex CLI). It publishes a benign marketplace plugin, then ships an update that binds malicious shell commands to ordinary runtime events; the harness executes those commands with host privileges without asking the model or the user again.
Is Claude Code vulnerable to plugin hook update attacks according to the paper?
The paper's motivating example (Fig. 3) shows Claude Code automatically loading three newly added hooks from a plugin update without item-level confirmation or re-authorization. The authors report successful attacks on all seven evaluated harnesses, but they also state that findings were disclosed to vendors and responses are still pending, so no vendor confirmation appears in the paper itself.
Why did Microsoft Defender detect 0% of these attacks?
In the paper's static 40:40 test corpus, Defender scanned sanitized malicious plugin bundles (manifests, hook configurations, shell payloads) and flagged none (0/40; 95% CI upper bound 8.8%). Defender is a signature and behavior-based endpoint antivirus, not a lifecycle-hook-aware scanner; the paper also tested Semgrep (19/40 detected) and its own eight-rule HookPolicy baseline (20/40 detected).
What fixes does the paper recommend for agent harnesses?
Authorize changed hook entries individually at update time, cryptographically bind plugin-manifest signatures to payloads, enforce least privilege on hook subprocesses, preserve original tool outputs with transformation provenance, and add runtime monitoring — because the paper's static scanning union still missed 47.5% of malicious artifacts.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure-embedded text (Figs. 1, 5–7) is heavily garbled by PDF extraction; the per-harness backend coverage counts cited from Fig. 5 radar labels (e.g., Copilot only on OpenHarness) could be misparsed from the scrambled label text.
- The anonymous artifact repository (anonymous.4open.science/r/HookPry-2EBD) was not inspected (no network access), so the completeness of the staged artifact release is unverified.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.