A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses towards Malicious Behaviors

arXiv:2609.03884 · cs.CR, cs.AI · Submitted 2026-09-03 · Read on arXiv

cs.CR, cs.AI

Submitted: 2026-09-03

Updated: 2026-09-08

Comments: 18 pages, 8 figures

Code: https://github.com/HKUDS/OpenHarness

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Decoupling — 8× in this paper · explained in 2 episodes
• Benchmark — 7× in this paper · explained in 2 episodes
• Temporal Decoupling — 7× in this paper
• Adversarial Manifest Optimization — 6× in this paper
• Ablation — 5× in this paper · explained in 1 episode
• Benchmarking — 5× in this paper · explained in 3 episodes
• Least Common Interface — 5× in this paper
• Robustness — 5× in this paper · explained in 5 episodes
• Agent Harness — 3× in this paper · explained in 1 episode
• Agent Skills — 3× in this paper · explained in 1 episode
• Core — 3× in this paper · explained in 2 episodes
• Ablation study — 2× in this paper · explained in 1 episode
• Agentic AI — 2× in this paper · explained in 1 episode
• International Conference on Learning Representations — 2× in this paper
• International Conference on Machine Learning — 2× in this paper
• Trace — 2× in this paper · explained in 2 episodes
• Adaptation — 1× in this paper · explained in 1 episode
• Agent Architectures — 1× in this paper · explained in 1 episode
• Alignment — 1× in this paper · explained in 1 episode
• Embeddings — 1× in this paper · explained in 2 episodes
• Findings of the Association for Computational Linguistics — 1× in this paper
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Multi-Agent System — 1× in this paper · explained in 5 episodes
• Provenance — 1× in this paper · explained in 3 episodes
• RAG — 1× in this paper · explained in 3 episodes
• Verifiability — 1× in this paper · explained in 2 episodes
• Verification — 1× in this paper · explained in 2 episodes

Sources

• Dynamic Malicious Skills in Agentic AI
• Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats
• Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance
• ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers
• Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE
• SMCP: Secure Model Context Protocol
• "Your AI, My Shell": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors
• Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning
• Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens
• From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent
• MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs