AL Alfred 2026-09-06 4 min read

HookPry: AI Agent Hook Updates Compromise All 7 Harnesses

Every serious agent harness ships lifecycle hooks: shell commands bound to runtime events like session start, tool calls, and file edits. They execute with host privileges, they're configured outside the model's context, and several fire at moments the LLM never observes. A paper posted Sep 3 by Pengxun Li, Litian Zhang, Jianwei Hou, Shujiang Wu, Song Li, and Zifeng Kang treats the update path for that configuration as an attack surface — and answers with HookPry, a fully automated attack framework. The receipts: 1,000 end-to-end runs across 25 harness/backend combinations, all seven harnesses compromised, per-harness success rates up to 92.5%. Microsoft Defender caught 0% of the malicious artifacts.

What Problem Does This Solve?

Prompt injection research asks what happens when the model is deceived. This paper asks what happens when nobody is — when code runs on the host that the model never sees. The threat model is supply-chain minimal: the attacker controls only plugin metadata and lifecycle-hook configuration for an installed plugin. No code execution, no model compromise, no access to your terminal. The question is whether a benign, versioned plugin can be trojanized by an update that binds attacker-chosen shell commands to benign lifecycle events. The harnesses, per the paper's finding, trust that update path blindly.

The Method: HookPry

HookPry (open-source) systematizes the abuse across heterogeneous harnesses. It takes a legitimate plugin, pushes an update that rebinds its hooks — attaching attacker-chosen commands to events like session start or pre/post tool-call — and lets the harness's own lifecycle machinery do the rest. Because the payload executes host-side as lifecycle configuration, it bypasses the model's judgment entirely: there is no turn in which the LLM could notice or refuse. The framework realizes ten distinct attack objectives, including privilege escalation, and measures end-to-end compromise across seven harnesses and multiple LLM backends.

flowchart LR
    A["Benign versioned
plugin installed"] --> B["Attacker controls
metadata + hook config"]
    B --> C["Update pushed —
harness trusts blindly"]
    C --> D["Hooks rebound: shell commands
bound to benign events"]
    D --> E["Fires host-side —
LLM never observes it"]
    E --> F["Privilege escalation
+ 9 other objectives"]

The Results: Seven for Seven

Across 1,000 end-to-end runs spanning 25 harness/backend combinations, HookPry compromised all seven evaluated harnesses, with per-harness success rates reaching 92.5%. All ten attack objectives were realized. The defense results are the part that should sting: Microsoft Defender showed 0% recall on the malicious artifacts, and the union of three static defenses still missed 47.5%. This isn't a novel-architecture exploit — it's a design-level blind spot that existing tooling doesn't even model as malicious.

Limitations

The threat model requires the attacker to control an installed plugin's metadata and hook configuration — a compromised publisher, registry, or update channel — not a zero-click remote exploit of arbitrary harnesses. The evaluation, while broad (7 harnesses, 25 combinations), is academic: production harnesses with stricter update signing or permission prompts may fall outside the tested set. The static defenses tested are representative, not exhaustive, and the paper demonstrates host-side compromise rather than measuring real-world exploitation in the wild. And "fires without the LLM observing" is partly by design — the same convenience that makes hooks useful is what HookPry weaponizes.

Why Builders Should Care

If you maintain or deploy an agent harness with hooks, your plugin update channel is currently part of your trusted computing base — and HookPry shows attackers need only metadata-level control of it. Concrete moves: pin plugin versions and verify updates cryptographically; treat hook-config changes as high-risk diffs that require human review; alert on any hook binding privileged shell commands to broad events like session start; log hook invocations as first-class audit events, separate from model activity. The deeper lesson mirrors the NixOS strip-backdoor case from last week: the update path is the attack. The model isn't the vulnerability. The trust you extend around it is.

Verdict: receipts, not rhetoric. One thousand runs, seven harnesses, zero AV recall. Until hook updates are verified and reviewed like production infrastructure, every agent harness in production is carrying a loaded update channel.

Related Posts