An arXiv paper (2609.03884) argues that “hooks” — the commands a coding agent runs at certain points in its lifecycle — are an attack surface almost nobody is watching. With their HookPry tool, the authors compromised all seven harnesses evaluated, including Claude Code and Codex CLI, with success rates of up to 92.5%.
What a Hook Is and Why It Matters
A “harness” is the program that wraps a model and gives it tools: Claude Code, Codex CLI and the like. Hooks are shell commands the harness runs automatically on certain events (before a tool call, when a session ends, and so on). Plugins declare them in their configuration. According to the study, those commands run with the user's privileges on the machine, and some fire at moments the model never gets to observe, so even the agent itself can't “notice.”
The Attack: An Update to a Legitimate Plugin
The threat model is a supply-chain one. The attacker controls only the plugin's metadata and its hook configuration. A benign, versioned plugin is trojanized through an update that quietly binds attacker-chosen commands to harmless events, producing malicious behavior on the host, including privilege escalation. According to the authors, the harnesses trust that update without verifying it.
Why Current Defenses Fail
Static scanners look for malicious code in a plugin's contents; here the “malicious” part is a line of configuration pointing at a command. Adversa's summary adds that Defender, Semgrep and baseline policies missed nearly half of the samples, and that reviewing updates is a more useful control today than scanning them.
What to Do in a Company
1) Pin versions of agent plugins and extensions and turn off auto-update. 2) Review hook-configuration diffs on every update, the same way you review dependencies. 3) Log hook execution and block packages from rewriting the agent's configuration or startup files. 4) Run agents under unprivileged accounts with no access to production credentials.
Sources: arXiv 2609.03884; Adversa summary (October 2026).