Prepare to Disallow the Dynamic Loading of Agents

Prepare to Disallow the Dynamic Loading of Agents is added in Java 21 (JEP 451).

Agents are powerful tools to work with JVM. An agent can alter the code of an application while the application is running. Agents can transform classes during class loading, or redefine classes loaded earlier. JDK 6 introduced the Attach API, which allows a tool to connect to a running JVM and communicate with that JVM. The Attach API also allows loading an agent dynamically into a running JVM.

Dynamically loading an agent can be dangerous, given that an agent can modify arbitrary classes in a running application.

In Java 21, when an agent is loaded dynamically, a warning is issued. To allow agents loaded dynamically without warnings, the -XX:+EnableDynamicAgentLoading option must be provided.

The dynamic loading of agents will be disallowed by default in a future Java release. In that case, the -XX:+EnableDynamicAgentLoading option will be required.

Agents can still be loaded at startup using the -javaagent option, the -agentlib option, and the Launcher-Agent-Class JAR file attribute.