AI 安全
HookPry Hijacks Updates to Compromise Seven AI Agents, Turning Lifecycle Hooks into an Execution Channel Outside Model Guardrails
Researchers were able to make previously trusted agent plugins execute malicious commands with host privileges by modifying only plugin metadata and hook configurations. All seven agents covered by 1,000 experiments were compromised at least once, but the success-rate and antivirus false-negative findings have not been independently reproduced.
Lifecycle hooks in AI coding agents were originally designed to automatically run tests, scan diffs, or add context. They have now been shown to potentially bypass model-layer tool approvals. A new paper introduces HookPry: attackers first publish a functional, versioned plugin and gain users’ trust, then add or replace commands bound to events such as `SessionStart`, tool calls, and file changes through an update. These commands are launched directly by the agent framework; the model may not see them and does not need to select the tool again.
HookPry divides the attack into three parts: using adversarial metadata to increase the likelihood that a malicious package will be discovered and installed; separating the benign initial installation from the malicious update to evade initial review; and using a common interface to translate payloads into each framework’s native hook format. The study covered five model backends and 25 framework–backend combinations, conducting 1,000 end-to-end tests targeting ten objectives, including privilege escalation and data exfiltration. The authors report a micro-averaged success rate of 77%. All seven tested frameworks produced an externally verifiable malicious effect at least once, while the highest success rate for a single framework reached 92.5%.
Traditional static scanning also failed to provide a reliable security boundary. Among 40 malicious and 40 benign synthetic samples, the Microsoft Defender configuration used by the authors detected none of the malicious samples. The combined detections from Defender, HookPolicy, and five Semgrep rules still missed 47.5%. These results show only that the experimental configuration was insufficient; they cannot be generalized to conclude that all endpoint protection is ineffective, because the samples, operating systems, and enterprise policies tested were limited.
The key engineering takeaway is to treat hook configuration as executable privilege, not as an ordinary configuration file. Updates should undergo semantic diffing of events, commands, network destinations, environment variables, and script paths. Any expansion of privileges should require reauthorization, and hooks should run within restricted filesystem, network, and credential environments. Logs should also retain the plugin version, configuration hash, triggering event, and actual execution identity.
The findings currently remain results from a synthetic research environment and do not establish that such attacks have occurred in real-world plugin marketplaces. The code is also available through an anonymous research repository, while vendor remediation status and cross-platform reproducibility remain to be confirmed. The most important issue to watch next is whether agent marketplaces can recalculate a plugin’s effective capabilities for every update and bring hooks within the same approval and audit boundary as model-initiated tool calls.