A paper posted on 3 September describes a supply-chain attack on AI coding agents that alters nothing an ordinary review would look at. It changes only a plugin's lifecycle-hook configuration, and it changes it on update — after the plugin has already been vetted and installed.
What was tested
The authors evaluate ten attack objectives across 25 combinations of harnesses and backends in 1,000 end-to-end runs. The result: the technique "compromises all seven evaluated harnesses, with per-harness success rates reaching 92.5%." The framework is released as open source under the name HookPry.
The detection numbers are the load-bearing part
Microsoft Defender has 0% recall against it, and "the union of three static defenses misses 47.5% of malicious artifacts." A named endpoint-security product missing all of it is the figure that matters to anyone running agent plugins on developer machines, because lifecycle hooks execute shell commands with host privileges on events the model never sees. Nothing in the model's safety training or the user's approval prompts sits anywhere in that path.
Why the update path is the novel bit
Version pinning and one-time review both assume that what was audited is what runs. Here a plugin that was genuinely benign when reviewed is weaponised later through configuration alone — no new code, no new package. That is the gap the paper opens, and it is not covered by the controls most teams have.
What the received framing gets wrong
Three qualifications belong with the headline. 92.5% is the ceiling across harnesses, not an overall rate — success rates "reach" it, so the median harness is lower and the mean is never stated. "Compromises all seven harnesses" means at least one of ten objectives succeeded on each; that is coverage, not reliability. And the threat model is narrower than remote exploitation: the attacker must already control plugin metadata and hook configuration for a plugin the victim has installed and updates. That is a real supply-chain position, but it is a position that has to be obtained first. The seven harnesses are not named in the abstract, no vendor has responded, and there is no patch here to apply.