importantSYS.SOURCE: The Hacker News• 2026-09-18T16:31:01+05:30

Plugin4Shell Vulnerability Allows Unauthorized Plugin Code Replacement in Four AI Coding Agents

#ai #vulnerability #cybersecurity #software #supply-chain

A vulnerability in four AI coding agents allows attackers to replace pinned plugin code with malicious versions by exploiting branch name conflicts, bypassing version locks. The flaw affects Anthropic, OpenAI, GitHub Copilot, and Google Gemini CLI, with some vendors having patched the issue and others not.

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday.

The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no

Read original article

*** END OF TRANSMISSION ***

> ANDROID 17 QPR1 INTRODUCES NEW APIS EXCLUSIVELY FOR PIXEL OS WITHOUT AOSP RELEASE > LINGUISTIC ILLEGIBILITY IN LARGE LANGUAGE MODELS: IMPLICATIONS FOR SECURITY > DIRECT SEMANTIC COMMUNICATION BETWEEN LARGE LANGUAGE MODELS VIA CACHE-TO-CACHE MECHANISM > OPTIMIZING MEMORY USAGE WITH MATHEMATICAL TECHNIQUES AND RUST PROGRAMMING > TYPESAFE AI'S JEV MODEL OFFERS CALIBRATED DECISIONS FOR SOFTWARE AUTOMATION > APPLE UNVEILS IPHONE DUO SIMULATOR AND XCODE 27.1 BETA FOR DEVELOPERS > U.S. BORDER AGENTS PERMITTED TO SEARCH CELLPHONES WITHOUT WARRANT OR SUSPICION > DISNEY'S FIRST CTO JOINS AI STARTUP PREVIOUSLY ACCUSED OF IP INFRINGEMENT > QUICK-COMMERCE PLATFORMS DELIVER NEW IPHONES IN MINUTES IN INDIA > GOOGLE INTRODUCES FAMILY-FOCUSED AI AGENT CC FOR HOUSEHOLD COORDINATION> ANDROID 17 QPR1 INTRODUCES NEW APIS EXCLUSIVELY FOR PIXEL OS WITHOUT AOSP RELEASE > LINGUISTIC ILLEGIBILITY IN LARGE LANGUAGE MODELS: IMPLICATIONS FOR SECURITY > DIRECT SEMANTIC COMMUNICATION BETWEEN LARGE LANGUAGE MODELS VIA CACHE-TO-CACHE MECHANISM > OPTIMIZING MEMORY USAGE WITH MATHEMATICAL TECHNIQUES AND RUST PROGRAMMING > TYPESAFE AI'S JEV MODEL OFFERS CALIBRATED DECISIONS FOR SOFTWARE AUTOMATION > APPLE UNVEILS IPHONE DUO SIMULATOR AND XCODE 27.1 BETA FOR DEVELOPERS > U.S. BORDER AGENTS PERMITTED TO SEARCH CELLPHONES WITHOUT WARRANT OR SUSPICION > DISNEY'S FIRST CTO JOINS AI STARTUP PREVIOUSLY ACCUSED OF IP INFRINGEMENT > QUICK-COMMERCE PLATFORMS DELIVER NEW IPHONES IN MINUTES IN INDIA > GOOGLE INTRODUCES FAMILY-FOCUSED AI AGENT CC FOR HOUSEHOLD COORDINATION