A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors

The paper reports a new attack surface in AI agent harnesses: lifecycle hooks that bind shell commands to runtime events. By updating only the hook configuration, an attacker can silently inject malicious commands into a benign plugin, enabling host‑side attacks such as privilege escalation. The authors present HookPry, an automated framework that demonstrates this vulnerability across 25 harness‑backend combinations, compromising all evaluated harnesses with high success rates.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

• llms
• agents