Search papers, labs, and topics across Lattice.
This paper identifies a critical vulnerability in AI agent harnesses related to lifecycle hooks that allow attacker-controlled updates to execute malicious commands with host privileges. By exploiting this blind trust in lifecycle-hook configurations, the authors demonstrate how benign plugins can be trojanized to perform harmful actions, including privilege escalation. Their automated attack framework, HookPry, successfully compromises all evaluated harnesses with a high success rate, highlighting the inadequacy of existing defenses against such supply-chain threats.
Attackers can exploit lifecycle-hook updates to execute malicious commands with host privileges, compromising AI agent harnesses at alarming rates.
Modern AI agent harnesses expose lifecycle hooks that bind shell commands to runtime events such as session start, tool calls, and file edits. These commands run with host privileges yet ship as lifecycle-hook configuration and may fire at times the LLM never observes. We identify the lifecycle-hook update path, which harnesses trust blindly, as a new attack surface. Under a supply-chain threat model in which an attacker controls only plugin metadata and lifecycle-hook configuration, a benign versioned plugin can be trojanized by an update that silently binds attacker-chosen commands to benign events, yielding malicious host-side behavior such as privilege escalation. We propose HookPry, an open-source and fully automated attack framework that systematically exploits this vulnerability across heterogeneous AI agent harnesses. HookPry realizes ten attack objectives; across 25 combinations of harnesses and backends in 1,000 end-to-end runs, it compromises all seven evaluated harnesses, with per-harness success rates reaching 92.5%. Representative defenses remain insufficient: Microsoft Defender has 0% recall, and the union of three static defenses misses 47.5% of malicious artifacts.
