What's this about?
A paper (HookPry) tested the lifecycle-hook systems of seven agent harnesses — the mechanism that lets users bind shell commands to events like "session start" or "file edited." Those commands run with the host's privileges, and every harness tested trusted the hook *update* path blindly: a plugin that was benign when installed can be trojanized purely through an update. Ten attack objectives, 25 harness/backend combinations, 1,000 end-to-end runs — all seven harnesses compromised. It landed the same day Anthropic announced Claude Code Function Hooks.
What exactly is a "lifecycle hook"?
It's automation glue: "when X happens, run this command." Like a doorbell that can be wired to any switch in your house — enormously useful, and exactly as dangerous as whatever it's wired to, because hooks execute arbitrary shell commands outside the model's permission system. The paper's point is that the trust model stops at install time: nobody re-checks what an update changed.
Why is this worth noting?
- The attack needs no model jailbreak at all — it's pure supply chain, hitting the harness layer where permissions aren't mediated.
- The timing gives it unusual leverage: Anthropic is actively soliciting feedback on a new hooks design right now, so this is a rare case of the vulnerability class being documented *before* the feature ships.
- For anyone running agent plugins from marketplaces: the paper's threat model is your setup.