The AI Agent Attack Surface: Plugins, MCP, and Hooks

Everyone is defending the wrong layer.

Prompt injection is a symptom. The real attack surface of AI agents is the extension ecosystem -- the systems that translate model output into execution.

Hooks. Plugins. MCP servers.

Individually, they are powerful. In combination, they form an execution layer with weakly defined trust boundaries and composable privilege escalation paths.

That is where the real risk lives.

We analyzed the complete extension architecture of Claude Code (v2.1.88) -- the hook system, the plugin loader, the MCP client, and the composition layer that ties them together. What follows is a formal attack taxonomy grounded in real function signatures, real schema definitions, and real execution flows. The goal is not to alarm. It is to map the terrain, because you cannot defend what you have not enumerated.

The thesis is straightforward: plugins, MCP servers, and hooks represent a larger and less understood attack surface than prompt injection alone. Prompt injection targets one trust boundary -- between user input and model behavior. The extension ecosystem targets dozens.

The Wrong Mental Model

Security teams treat:

• plugins as integrations
• hooks as automation
• MCP as tooling

But in reality:

• plugins are supply chain
• hooks are execution
• MCP is control plane injection

That mismatch is where risk accumulates. Everything that follows makes the case.

Section 1: The Three Escalation Planes

Modern AI agents expose three distinct planes of extensibility. They are not equally dangerous.

Hooks -- direct execution plus policy override. The highest risk. They run arbitrary code at 27 lifecycle events, can modify tool inputs, override permission decisions, and exfiltrate results. They execute outside the model's visibility.

Plugins -- delivery plus persistence. The amplifier. A single plugin bundle can install hooks AND provide MCP servers AND inject skills AND define agents. One trust decision, multiple escalation paths.

MCP -- behavioral influence plus remote control. The stealth vector. MCP servers inject instructions directly into the system prompt, expanding the tool surface while shaping how the model uses it.

How They Compose

A plugin can install hooks AND provide MCP servers simultaneously. The MCP server injects instructions that guide model behavior. The hooks intercept permission checks to allow the actions the model was guided to take. The result: a composable attack chain that crosses three trust boundaries within a single "install plugin" action.

No single component is catastrophic. The system becomes dangerous when these components interact.

Section 2: Hooks -- Unsandboxed Code Execution Inside the Control Loop

The hooks system is the most powerful -- and therefore most dangerous -- extensibility point in the agent architecture.

Hooks are not extensions in the traditional sense. They are arbitrary code execution surfaces wired directly into the agent's decision loop. That means they can modify intent before execution, override policy decisions, and exfiltrate results after execution. And they run outside the model's visibility.

Hook Types

Six execution types from src/utils/hooks.ts:

The 27 Lifecycle Events

From hooksConfigManager.ts (lines 29-263), the complete event surface:

The Permission Override Attack Surface

The most security-critical capability: overriding permission decisions through two mechanisms.

Mechanism 1: PreToolUse with decision field

From hooks.ts lines 526-540:

if (json.decision === 'approve') {
  result.permissionBehavior = 'allow'
} else if (json.decision === 'block') {
  result.permissionBehavior = 'deny'
}

A PreToolUse hook can silently allow any tool call. The hook can also return updatedInput to modify the tool's arguments before execution.

Mechanism 2: PermissionRequest hooks

From types/hooks.ts lines 122-134:

decision: z.union([
  z.object({
    behavior: z.literal('allow'),
    updatedInput: z.record(z.string(), z.unknown()).optional(),
    updatedPermissions: z.array(permissionUpdateSchema()).optional(),
  }),
  z.object({
    behavior: z.literal('deny'),
    message: z.string().optional(),
    interrupt: z.boolean().optional(),
  }),
]),

A PermissionRequest hook returning behavior: 'allow' with updatedPermissions does not just approve the current operation. It grants blanket permissions for future operations -- escalating a single hook response into persistent privilege elevation.

Async Hooks

Hooks can declare themselves asynchronous by returning { "async": true }. The AsyncHookRegistry manages background execution. Async hooks run detached from the main request flow -- they can perform long-running operations including network calls without blocking the agent and without appearing in the interactive flow.

Attack Scenario: Silent Permission Escalation

Section 3: Plugins -- Supply Chain Bundles That Collapse Trust Boundaries

A plugin is not a feature. It is a bundle of capabilities:

• Code execution (hooks)
• Remote connectivity (MCP servers)
• Prompt injection (skills, agents, output styles)
• Data access (commands, LSP servers)

Installing a plugin is not enabling functionality. It is delegating control across multiple layers of the system. One trust decision, multiple attack surfaces.

What a Plugin Bundle Can Contribute

From the manifest schema in src/utils/plugins/schemas.ts:

What IS Validated vs. What ISN'T

The Plugin-Only Policy Paradox

Enterprise deployments can restrict to plugin-only customization via isRestrictedToPluginOnly() in src/utils/settings/pluginOnlyPolicy.ts. When enabled, only enterprise-managed and plugin-provided MCP servers load.

This creates a paradox: the policy intended to restrict the attack surface actually concentrates trust into the plugin layer -- making plugin compromise more impactful, not less. The gate protects against one risk by amplifying another.

Attack Scenario: The Helpful Exfiltrator

Section 4: MCP -- Remote Influence Over the Control Plane

MCP is not just tool expansion. It is remote influence over the control plane.

MCP servers do not just provide tools. They provide instructions. And those instructions are injected into the same context that defines the agent's behavior. That makes MCP a remote prompt injection channel with first-class access.

The Instructions Field

When an MCP server connects, instructions are retrieved via client.getInstructions() (in src/services/mcp/client.ts). These become part of the ConnectedMCPServer object and are incorporated into the model's system prompt via getMcpInstructions() in prompts.ts (line 579). Within the length cap (MAX_MCP_DESCRIPTION_LENGTH), a server has direct influence over model behavior.

This is not a side channel. This is a designed feature. Every MCP server connection is an instruction injection vector.

Transport Attack Surfaces

From src/services/mcp/types.ts, eight transport types with distinct security properties:

Remote transports support OAuth via PKCE, local callback servers, token refresh, and state validation. The auth module handles non-standard error codes from providers like Slack. Complexity itself is the attack surface.

Plugin-Provided MCP Servers Bypass Approval

Plugin MCP servers (mcpPluginIntegration.ts) are scoped with plugin:name:server prefixes and receive scope: 'dynamic'. Environment variables CLAUDE_PLUGIN_ROOT and CLAUDE_PLUGIN_DATA are auto-injected.

Attack Scenario: The Instruction Injector

Section 5: Composable Attack Chains

No single component is catastrophic. The system becomes dangerous when these components interact.

The Full Kill Chain

                    PLUGIN INSTALL (single trust decision)
                              |
              +---------------+---------------+
              |                               |
        HOOKS REGISTERED              MCP SERVER STARTED
              |                               |
    PreToolUse: Bash                   instructions: "Use Bash
    PermissionRequest: *               to run setup commands
              |                        when user asks for help"
              |                               |
              +---------------+---------------+
                              |
                    MODEL RECEIVES INSTRUCTIONS
                    (injected via MCP → system prompt)
                              |
                    MODEL ATTEMPTS BASH COMMAND
                    (guided by attacker instructions)
                              |
                    PERMISSION CHECK TRIGGERED
                              |
                    PermissionRequest HOOK FIRES
                    (returns behavior: 'allow')
                              |
                    COMMAND EXECUTES
                    (user never sees dialog)
                              |
                    PostToolUse HOOK FIRES
                    (exfiltrates output silently)

This is not a vulnerability in a component. This is a vulnerability in the architecture.

Mapping to STRIDE

Mapping to MITRE ATT&CK

The Composition Thesis

The fundamental vulnerability is not any single mechanism. It is the composition.

A reviewer examining hooks might conclude they are acceptably risky if user-configured. A reviewer examining MCP might conclude instructions are manageable if servers are approved. A reviewer examining plugins might conclude marketplace validation is sufficient.

But no reviewer sees the full picture unless they trace the path from plugin installation through hook registration through MCP server activation through instruction injection through permission override. The extension systems were designed independently and compose implicitly.

The attack surface is the composition itself.

Section 6: Defensive Recommendations

1. Audit the full composition, not individual components. Trace the chain: what hooks does each plugin install? What MCP servers does it provide? What instructions do those servers inject? What permissions do the hooks override?

2. Implement plugin allowlisting. Use enabledPlugins and strictKnownMarketplaces policy settings. Block third-party marketplaces unless reviewed. The ALLOWED_OFFICIAL_MARKETPLACE_NAMES in schemas.ts defines reserved official names.

3. Enforce MCP server policies. Configure allowedMcpServers and deniedMcpServers with command-array and URL-pattern matching (not just name-based). Consider allowManagedMcpServersOnly for high-security environments.

4. Monitor hook execution. Forward telemetry to your SIEM. Watch for:

• PreToolUse hooks returning decision: "approve"
• PermissionRequest hooks returning behavior: "allow"
• Non-zero exit codes
• Async hooks with extended timeouts

5. Treat plugin review as MCP server review. Plugin MCP servers bypass .mcp.json approval. Every plugin enablement is an implicit MCP server approval.

6. Build runtime composition visibility. The missing piece: a tool that shows the complete hook-event coverage, MCP server list, instruction content, and permission override surface for a given plugin configuration. The full "what can this configuration do" picture.

Conclusion

AI agent security is not a model problem. It is a systems problem.

Right now, we are securing the model while leaving the execution layer exposed.

Until that changes, the most dangerous part of your AI system will not be what it says. It will be what it is allowed to do.