September 7th Research Briefing

Contents

1. BUGSTONE-E2E: CVE patch history becomes runtime-validated findings
2. HookPry: lifecycle-hook updates compromise AI agent harnesses
3. PrimSynth: agentic synthesis of Linux kernel exploit primitives

BUGSTONE-E2E: CVE patch history becomes runtime-validated findings

BUGSTONE-E2E turns verified CVE fixing commits into executable detection rules, then runs them until runtime evidence and scope-checked patches. From 19,325 high-severity CVEs (2022-2026) it verifies 2,710 fixing commits and builds 1,033 rules across 56 CWE families (172 skills). On 14 programs it reports 2,933 deduplicated findings and runtime evidence for 644 of them, including AddressSanitizer violations and crashes.

This matters because vulnerability databases already store the fixing commit, but scanners still need matchable anchors, fix semantics, and a check that does not trust a model verdict alone.

The pipeline mines rules from CVE history, applies them with Tree-sitter call-site enumeration plus LLM-agent inspection, then builds runtime checks before generating patches. Patch acceptance is a two-sided differential test: the PoC must fail on the patched tree and succeed again after revert. On 23 findings with live PoCs, every generated patch passed that check (median eight changed lines). The paper does not claim general patch correctness.

Authors: Qiushi Wu, Kevin Eykholt, Youngja Park, Xiaokui Shu, Dhilung Kirat, Douglas Lee Schales, and Ian Molloy (paper, pdf). Qiushi Wu: Google Scholar.

HookPry: lifecycle-hook updates compromise AI agent harnesses

HookPry shows that AI agent harnesses can be compromised through the plugin update path for lifecycle hooks, without changing the plugin binary and without putting the payload on the LLM decision path. Under a supply-chain model where the attacker controls only plugin metadata and hook configuration, a later update can bind attacker-chosen shell commands to ordinary events (session start, tool calls, file edits). Those commands run with host privileges.

This matters because coding agents sit between user intent and a privileged host shell. Defenses that watch prompts or tool descriptions do not see a harness-dispatched hook subprocess once the event fires.

Across 25 harness and backend combinations in 1,000 end-to-end runs, HookPry compromises all seven evaluated harnesses (overall oracle-confirmed success 77.0%, peak 92.5% on Hermes). Microsoft Defender recall is 0% on this path, and three static defenses together still miss 47.5% of malicious artifacts. The authors report responsible disclosure. Artifact: HookPry.

Authors: Pengxun Li, Litian Zhang, Jianwei Hou, Shujiang Wu, Song Li, Zifeng Kang, and Xi Zhang (paper, pdf, HookPry).

PrimSynth: agentic synthesis of Linux kernel exploit primitives

PrimSynth discovers, validates, and synthesizes exploit primitives for Linux kernel memory-corruption CVEs, then chains them into multi-step strategies. It formalizes six primitive classes (OOB, UAF, double-free, arbitrary-write, control-flow hijacking, and info-leak) and grounds synthesis on validated state transitions inside a rebootable QEMU environment.

This matters because automated kernel exploitation often stalls between an abstract strategy and a concrete, version-specific sequence of objects and timings. A crash is not the same as a validated primitive that can be upgraded and composed.

On 16 real-world kernel CVEs spanning five vulnerability types, the paper reports a 100% primitive match rate, an 82.4% strategy synthesis rate when a public PoC is available, and 61.3% without primitive-hypothesis guidance (average 72.4 seconds end-to-end). Failed validation falls back rather than accepting a model-only claim.

Authors: Pengfei Wang, Anying Chen, Danjun Liu, Xu Zhou, and Wei Xie (paper, pdf).