AI coding agents will run malware buried inside a routine plugin update, no questions asked.
Researchers found that many AI agent harnesses expose "lifecycle hooks" - configuration that binds shell commands to events like session start, tool calls, or file edits. Those commands run with full host privileges, and they can fire without the underlying LLM ever seeing them. The team built HookPry, an open-source and fully automated attack framework, to show that an attacker who controls only a plugin's metadata and hook configuration can trojanize an already-trusted, versioned plugin. A routine-looking update silently attaches malicious commands to benign events, with no review of the agent's actual behavior required. Across 1,000 end-to-end runs spanning 25 combinations of harnesses and backends, HookPry pulled off ten distinct attack objectives, including privilege escalation, and compromised all seven harnesses tested, with per-harness success rates as high as 92.5%.
The real story here is what harnesses choose to trust. Prompts and generated code get scrutiny; lifecycle-hook configuration apparently does not, even though it runs with the same privileges as anything else on the host. That gap turns a boring version bump into a plausible attack vector, and the defenses meant to catch it barely register: Microsoft Defender flagged none of the malicious artifacts, and combining three static-analysis tools still missed 47.5% of them.
This is the same trick as dependency confusion or typosquatted packages, just aimed at a part of the stack nobody thinks to audit. Config isn't supposed to be where the exploit lives - which is exactly why it worked.