Agent harnesses trust plugin updates. A study compromised all seven it tested.
By Eric St-Pierre · Written with AI assistance, reviewed and verified by the author
- Agentic AI
- AI Security
- Coding Assistants
A September 2026 preprint shows that a lifecycle hook added in a plugin update runs with host privileges, often without re-authorization. Across 1,000 runs it compromised all seven agent harnesses evaluated, and three static scanners together still missed 47.5% of malicious artifacts.
What changed
On September 3, 2026, researchers from Beijing University of Posts and Telecommunications and three other Chinese institutions posted "A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors" to arXiv (arXiv:2609.03884). It is a preprint and has not been peer reviewed. A revised version followed on September 8.
The paper names an attack surface most teams have not inventoried: lifecycle hooks. Agent harnesses such as Claude Code, Codex CLI and OpenClaw let a plugin bind shell commands to runtime events, such as session start, a tool call or a file edit. Those commands run with the user's host privileges and can fire at moments the model never observes. The threat model is deliberately narrow: the attacker controls only a plugin's metadata and its hook configuration. A plugin is published benign, earns installation, and a later update binds attacker-chosen commands to ordinary events.
What the study actually shows
Read from the paper, kept separate from what anyone makes of it:
- Seven harnesses were tested: OpenHarness, OpenClaw, Claude Code, Codex CLI, OpenCode, Hermes and WorkBuddy, with five model backends. That is 25 harness and backend combinations, 40 attack cases and 1,000 end-to-end runs, in ephemeral environments with synthetic assets.
- Every harness was compromised. 77.0% of runs produced effects confirmed by an external oracle. The highest per-harness rate was 92.5%, on Hermes. No run was explicitly blocked by the model.
- In Claude Code, the authors report that an update to an already trusted plugin loads newly added hooks "without user notification, item-level confirmation, or re-authorization."
- Static scanning did not close the gap. On a corpus of 40 malicious artifacts and 40 matched benign ones, Microsoft Defender detected none. A Semgrep baseline caught 47.5% and the authors' own hook-aware policy caught 50%. Together, the three still missed 47.5% of the malicious artifacts. The Semgrep rules and the hook policy are researcher-configured baselines, not commercial defaults.
- The authors state that they disclosed the findings to all affected vendors and were awaiting responses.
The core observation is structural. In the authors' words, "the harness controls command binding and subprocess dispatch; the model affects only event generation. Prompt-layer defenses therefore miss this execution boundary."
What it means for an engineering team
Treat a plugin update as a new install. The trust decision was made about the version that was reviewed. A hook added in a later version is new executable code on a developer workstation, and in a regulated environment it belongs in the same change record as any other software of unknown provenance entering the development environment.
Pin plugin versions and review hook diffs. Where a harness cannot authorize a changed hook individually, turn off automatic plugin updates and route updates through review. The authors' own recommendations are to authorize changed hooks individually, bind manifest signatures to payloads, and enforce least privilege.
A model guardrail is the wrong control for this. The attack never asks the model for anything. Controls have to sit where the command is bound and executed: the harness configuration, the permissions of the process, and runtime monitoring on the host.
Assume a scanner will miss it. The paper's countermeasure results lead the authors to conclude that static scanning "cannot replace runtime monitoring and permission constraints." A workstation running an agent with host privileges needs the endpoint telemetry you would expect on a build server.
What is still unsettled
How the vendors respond. The paper records disclosure, not responses. Whether harnesses move to per-hook authorization on update decides whether this stays a configuration problem or becomes a design one.
How often it happens in practice. The study measures what an update can do once it is installed and adopted. It deliberately does not measure how many users install a given plugin or accept its updates, so it says nothing yet about prevalence.
Where plugin governance lives. A marketplace plugin for a coding agent is not clearly a dependency, a developer tool or an extension, and lockfiles, SBOMs and dependency review were not designed with it in mind.
How far the result generalizes. The authors list operating systems, shells, enterprise policies, network conditions and future harness versions as outside what the 40 cases cover.
Sources
- Li, P., Zhang, L., Hou, J., Wu, S., Li, S., Kang, Z. and Zhang, X. A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors. Preprint, arXiv:2609.03884 [cs.CR], first posted September 3, 2026, revised September 8, 2026.