importantSYS.SOURCE: The Hacker News• 2026-09-18T16:31:01+05:30

Plugin4Shell Vulnerability Allows Unauthorized Plugin Code Replacement in Four AI Coding Agents

#ai #vulnerability #cybersecurity #software #supply-chain

A vulnerability in four AI coding agents allows attackers to replace pinned plugin code with malicious versions by exploiting branch name conflicts, bypassing version locks. The flaw affects Anthropic, OpenAI, GitHub Copilot, and Google Gemini CLI, with some vendors having patched the issue and others not.

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday.

The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no

Read original article

*** END OF TRANSMISSION ***

> CURATED VIDEO PLATFORM LEVERAGING HACKER NEWS RECOMMENDATIONS > NES CONTRA (1987) NATIVE PORT VIA WEBASSEMBLY > CRITICAL LINUX IPV4 TCP USE-AFTER-FREE VULNERABILITY CVE-2026-98432 WITH CVSS 9.8 SEVERITY > RESPONSIBLE DISCLOSURE OF CPU SIDE-CHANNEL VULNERABILITIES AND ETHICAL RESPONSIBILITIES IN COMPUTER SECURITY > GPT-5.6 SOL COMPLETES PEACEFUL FACTORIO RUN IN 13.5 HOURS > MEMORY LATENCY'S IMPACT ON CPU UTILIZATION IN DATABASE GROUP BY OPERATIONS > THE IMPACT OF GENERATIVE AI ON CRITICAL THINKING: A SELF-REPORTED STUDY (2025)> WILLIAM NORDHAUS, NOBEL LAUREATE IN ECONOMICS, DIES AT 85 AFTER PIONEERING CLIMATE-ECONOMY RESEARCH > CYBERSECURITY BREACH EXPLOITS LED DISPLAY SOFTWARE VULNERABILITY ACROSS MULTIPLE COUNTRIES > US COPYRIGHT OFFICE CLARIFIES AI-GENERATED CONTENT COPYRIGHT ELIGIBILITY> CURATED VIDEO PLATFORM LEVERAGING HACKER NEWS RECOMMENDATIONS > NES CONTRA (1987) NATIVE PORT VIA WEBASSEMBLY > CRITICAL LINUX IPV4 TCP USE-AFTER-FREE VULNERABILITY CVE-2026-98432 WITH CVSS 9.8 SEVERITY > RESPONSIBLE DISCLOSURE OF CPU SIDE-CHANNEL VULNERABILITIES AND ETHICAL RESPONSIBILITIES IN COMPUTER SECURITY > GPT-5.6 SOL COMPLETES PEACEFUL FACTORIO RUN IN 13.5 HOURS > MEMORY LATENCY'S IMPACT ON CPU UTILIZATION IN DATABASE GROUP BY OPERATIONS > THE IMPACT OF GENERATIVE AI ON CRITICAL THINKING: A SELF-REPORTED STUDY (2025)> WILLIAM NORDHAUS, NOBEL LAUREATE IN ECONOMICS, DIES AT 85 AFTER PIONEERING CLIMATE-ECONOMY RESEARCH > CYBERSECURITY BREACH EXPLOITS LED DISPLAY SOFTWARE VULNERABILITY ACROSS MULTIPLE COUNTRIES > US COPYRIGHT OFFICE CLARIFIES AI-GENERATED CONTENT COPYRIGHT ELIGIBILITY