September 7th Research Briefing

1. BUGSTONE-E2E: CVE patch history becomes runtime-validated findings
2. HookPry: lifecycle-hook updates compromise AI agent harnesses
3. PrimSynth: agentic synthesis of Linux kernel exploit primitives

BUGSTONE-E2E: CVE patch history becomes runtime-validated findings

BUGSTONE-E2E turns verified CVE fixing commits into reusable, executable detection rules, then runs those rules through a funnel that ends in runtime evidence and scope-checked patches. From 19,325 high-severity CVEs (2022-2026) the pipeline verifies 2,710 fixing commits and builds 1,033 rules across 56 CWE families, packaged as 172 skills. On 14 programs, Phase B reports 2,933 deduplicated findings, and Phase C produces runtime evidence for 644 of them, including AddressSanitizer violations and crashes.

This matters because public vulnerability databases already store the hard part of many bugs (weakness class, affected component, and the fixing commit), but those records are written for humans. Scanners still need a different artifact: anchors that match elsewhere, fix semantics that separate buggy from benign call sites, and a verification contract that can be checked without trusting a model verdict alone. BUGSTONE-E2E treats the patch history as that missing detector, not as documentation to re-read by hand.

The method is a staged pipeline. Part 1 mines and generalizes rules from CVE history (scan anchors, buggy and fixed patterns, provenance). Part 2 applies those skills to a target tree with Tree-sitter call-site enumeration, cheap heuristic filtering, and LLM-agent inspection of the survivors. Part 3 re-triages candidates, builds runtime verifications, and only then generates patches. Patch acceptance uses a two-sided differential test: the proof of concept must fail on the patched tree and succeed again after the patch is reverted, so a broken build cannot pass as a fix.

Concrete evidence stays attached to each stage. The CVE-to-skill funnel shrinks 19,325 high-severity CVEs to 5,902 open-source enrichments, 2,710 verified commits, and 1,033 production rules. Across the 14-program registry, 644 findings carry runtime markers. In a small Phase D prototype on 23 findings with live PoCs (11 of them on the openai-python SDK), every generated patch passed the differential check, with a median of eight changed lines. The paper is clear that this sample does not measure general patch correctness or maintainer acceptance.

Authors: Qiushi Wu, Kevin Eykholt, Youngja Park, Xiaokui Shu, Dhilung Kirat, Douglas Lee Schales, and Ian Molloy (paper, pdf). Qiushi Wu: Google Scholar.

HookPry: lifecycle-hook updates compromise AI agent harnesses

HookPry shows that AI agent harnesses can be compromised through the plugin update path for lifecycle hooks, without changing the plugin binary and without putting the payload on the LLM decision path. Under a supply-chain model where the attacker controls only plugin metadata and hook configuration, a once-benign versioned plugin can later ship a hook that binds attacker-chosen shell commands to ordinary events (session start, tool calls, file edits). Those commands run with host privileges. Across 25 harness and backend combinations in 1,000 end-to-end runs, HookPry compromises all seven evaluated harnesses, with overall oracle-confirmed success at 77.0% and a per-harness peak of 92.5% on Hermes.

This matters because coding agents sit between user intent and a privileged host shell. Defenses that watch prompts, tool descriptions, or model alignment do not see a harness-dispatched hook subprocess once the event fires. The paper treats that blind trust in versioned hook updates as a software control-plane bug in agent tooling, not as a jailbreak.

HookPry automates ten attack objectives with three components. Adversarial Manifest Optimization engineers marketplace metadata so an initially benign plugin is discoverable. Temporal Decoupling separates that first install from a later hook-bearing update under the same identity. Least Common Interface maps one abstract payload onto each harness native hook schema. The evaluated harnesses are OpenHarness, OpenClaw, Claude Code, Codex CLI, OpenCode, Hermes, and WorkBuddy. Representative defenses remain weak on this path: Microsoft Defender recall is 0%, and the union of three static defenses still misses 47.5% of malicious artifacts. The authors report responsible disclosure to the affected vendors.

Authors: Pengxun Li, Litian Zhang, Jianwei Hou, Shujiang Wu, Song Li, Zifeng Kang, and Xi Zhang (paper, pdf, HookPry).

PrimSynth: agentic synthesis of Linux kernel exploit primitives

PrimSynth is a multi-agent framework that discovers, validates, and synthesizes exploit primitives for Linux kernel memory-corruption CVEs, then chains those primitives into multi-step strategies. It formalizes six primitive classes (out-of-bounds, use-after-free, double-free, arbitrary-write, control-flow hijacking, and info-leak) and couples primitive upgrading with path-synthesis constraints on objects, timing, environment, and validation signals. On 16 real-world kernel CVEs spanning five vulnerability types, the paper reports a 100% primitive match rate, an 82.4% strategy synthesis rate when a public PoC is available, and 61.3% without primitive-hypothesis guidance, with end-to-end synthesis averaging 72.4 seconds.

This matters because automated kernel exploitation usually stalls in the gap between an abstract strategy and a concrete, version-specific sequence of objects and timings. A crash or a single PoC is not the same as a validated primitive that can be upgraded and composed. PrimSynth treats that gap as the product: reproducible state transitions that agents can check before they generate more code.

Discovery agents gather CVE facts and location marks. Validation agents propose primitive hypotheses, drive vulnerability-directed execution, and confirm effects inside a rebootable QEMU environment with instrumented kernels, using signals from KASAN, gdb, and static layout tools such as PODE. Synthesis agents extract validated path snippets and run an execution-grounded loop (signal acquisition, rule checks, then template-based or strategy-guided generation) until multi-primitive artifacts land. Failed validation falls back rather than accepting a model-only claim. The evaluation covers OOB, UAF, double-free, race, and integer-overflow cases, including chains such as OOB to info-leak to arbitrary-write on public CVEs.

Authors: Pengfei Wang, Anying Chen, Danjun Liu, Xu Zhou, and Wei Xie (paper, pdf).