Lifecycle hooks are the unglamorous plumbing of coding agents, a line of configuration saying that when a session opens, or a file gets edited, or a tool is about to run, the harness should execute this shell command. The command runs with the developer's privileges. It never passes through the model.
Researchers built an automated framework that publishes a useful plugin to a marketplace, waits for it to be installed and trusted, then ships an update that binds attacker-chosen commands to those ordinary events. Across 1,000 runs against seven agent harnesses (Claude Code, Codex CLI and OpenClaw among them), every one of them could be compromised this way, with roughly three-quarters of attempts producing the intended result. Credentials were dumped, source files tampered with and permissions widened. Not one run was refused by the model, because there was nothing for the model to refuse.
"Coarse-grained trust in a plugin or update does not constitute informed approval of an added command."
A side experiment sharpens the point. The team took a batch of known malicious tool descriptions, the familiar attack that tries to talk the model into doing something, and re-ran them as hook configuration instead. As text the model had to be persuaded by, they worked 56% of the time; fired directly by the harness, 92%. The researchers attribute the gap to the removal of the model as a gate. Most agent security spending sits on the wrong side of this boundary, buying scrutiny of what the model proposes while the harness runs whatever configuration tells it to.
The authors' proposed fix follows from their own teardown of the attack. Close the gap between approving a plugin and that plugin acquiring hook privileges, and the whole thing stops working. They argue harnesses should re-authorise changed hooks individually on update.
That's the right fix, and it isn't one an engineering leader can ship. What's available today is narrower. Find out whether your harness prompts again when an update adds a hook. That's a configuration fact, checkable this afternoon, and most teams have never checked it. Treat "the agent asks before running commands" in a vendor pitch as a claim about tool calls the model proposes, which is a different code path from hooks the harness fires. Endpoint antivirus caught none of these artifacts, so it isn't the compensating control here, though the bundles were synthetic and sanitised and the scanners tried were off-the-shelf. Unproven on this path, rather than proven useless.
"Agent security must therefore audit plugin updates, hook registration, subprocess permissions, and tool-output integrity as one trust chain; model-level content protection does not cover this path."
The study could not establish that anyone would install the plugin or take the update. Its whole chain assumes both, and marketplace adoption sat outside what the experiments measured. But the prior question is the one most organisations can't answer either. Which agent plugins are on which developer's machine, and what do they run when nobody is looking?
Sources
- Li, P., Zhang, L., Hou, J. et al., "A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors" — https://arxiv.org/abs/2609.03884