A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors
Modern AI agent harnesses expose lifecycle hooks that bind shell commands to runtime events such as session start, tool calls, and file edits. These commands run with host privileges yet ship as lifecycle-hook configuration and may fire at times the LLM never observes. We identify the lifecycle-hook update path, which harnesses trust blindly, as a new attack surface. Under a supply-chain threat model in which an attacker controls only plugin metadata and lifecycle-hook configuration, a benign versioned plugin can be trojanized by an update that silently binds attacker-chosen commands to benign
Lineage graph
Paper → model → repo connections mined from source citations (Tier-1 exact match).
Why these links exist
Every edge carries a method, confidence, and the source snippet that justified it — so bad links are debuggable.
- FuzzySimilar title/name (fuzzy) · 59%AgentCore-8B →
“Fuzzy title match (0.73): “A Blind Trust, the Bloody Thrust: When Attacker-Controlled H” ≈ “AgentCore-8B””
- FuzzySimilar title/name (fuzzy) · 87%SWE-agent/SWE-agent →
“Fuzzy title match (0.94): “A Blind Trust, the Bloody Thrust: When Attacker-Controlled H” ≈ “SWE-agent/SWE-agent””
- FuzzySimilar title/name (fuzzy) · 87%zhayujie/CowAgent →
“Fuzzy title match (0.94): “A Blind Trust, the Bloody Thrust: When Attacker-Controlled H” ≈ “zhayujie/CowAgent””
- FuzzySimilar title/name (fuzzy) · 59%iflytek/astron-agent →
“Fuzzy title match (0.73): “A Blind Trust, the Bloody Thrust: When Attacker-Controlled H” ≈ “iflytek/astron-agent””
- FuzzySimilar title/name (fuzzy) · 59%NousResearch/hermes-agent →
“Fuzzy title match (0.73): “A Blind Trust, the Bloody Thrust: When Attacker-Controlled H” ≈ “NousResearch/hermes-agent””
- FuzzySimilar title/name (fuzzy) · 59%bojieli/ai-agent-book →
“Fuzzy title match (0.73): “A Blind Trust, the Bloody Thrust: When Attacker-Controlled H” ≈ “bojieli/ai-agent-book””
- PossiblePossibly related (embedding) · 51%Why this month's Microsoft patch release is a doozy →
- LinkedLinked via arxiv author · 85%Pengxun Li →
“A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behav”