As cited
Copy frozen at (site build).
vulnerabilities
Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents
A vulnerability in four artificial intelligence (AI) coding agents allows repository owners to replace pinned plugin code with malicious versions, bypassing version locks that agents enforce. Anthropic patched the flaw in Claude Code 2.1.179, and OpenAI addressed it in Codex 0.146.0, while GitHub Copilot's status remained unclear.
Why it matters: Developers using these AI agents face supply chain risk if their plugin repositories are compromised; organizations should update to patched versions and review plugin sourcing practices.
- Source published
- First seen by Cybersecurity Tracker