Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

Summary: Air Security reported on Thursday that a flaw in four AI coding agents lets a plugin repository owner swap reviewed, commit-hash-pinned plugin code for malicious code, because the agents fetch the pinned snapshot but never verify the code matches it. Anthropic patched Claude Code 2.1.179 and OpenAI patched Codex 0.146.0, GitHub Copilot has no fix, and Google will not patch the Gemini CLI, which it is retiring; Air built a working attack against all four in May, told vendors in June, and as of September 18 no CVE had been assigned and no vendor advisory had been published.
Bottom line: A swapped plugin runs with the same access as the person using the agent, reaching their files, saved credentials, and the systems they can log in to - and because each agent checks the lock on the user's own machine, no marketplace can fix this for you; the fix has to ship in the agent itself.

Read the original at The Hacker News ↗