[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUKtagcgGty2w1rhGbzKo5tup9enpkcpxNiYHklSuAqc":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"6128f6ae-6d95-456d-ade3-058e942f1959","Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents","plugin4shell-lets-repository-owners-swap-pinned-plugin-code-across-four-ai-codin-68651e","A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no","A vulnerability dubbed Plugin4Shell affects four major AI coding agents, allowing repository owners to substitute malicious code for legitimate, pinned plugins. This occurs even when the agent has locked the plugin to a specific reviewed version. While Anthropic and OpenAI have released patches, GitHub Copilot remains unfixed, and Google will not patch the retiring Gemini CLI. The attack exploits how some Git hosts permit branch names that mimic commit hashes, enabling the agent to install different code while reporting the pinned version.","Flaw in AI coding agents allows repo owners to swap pinned plugin code for malicious versions.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fplugin4shell-lets-repository-owners.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEizNK9maRYTbrRVwr9_9b7Sm_IizPdRJh0AbH1GtKU1BNPrcxJydnUdRQxRxauE5p1ejpfk4ihANpP7HAoXbRCDD1Pu-ZZD1dnfzLFjysOSJm7gGRKYrkUjxVF-tX-0neJMQtN87iyk1DRD70hKKtFU_J6idWK4aoZr3k4DAz4q8pkjTfKTX10Vttaiwag\u002Fs1600\u002Fcoding-agents.jpg","2026-09-18T11:01:01+00:00","2026-09-18T14:00:20.835632+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":19},"Codex",{"name":23,"type":19},"GitHub Copilot",{"name":25,"type":19},"Gemini CLI",{"name":27,"type":28},"Anthropic","vendor",{"name":30,"type":28},"OpenAI","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",[],[27,30,18],{"controls":52,"vendors":134},[53,82,107],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":48,"name":83,"problem":84,"products":85},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[86,94,99],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-ai-gateway","Boomi AI Gateway","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fai-gateway\u002F","Gateway for AI model and MCP tool traffic, built on Lunar.dev technology. It limits which tools each agent can call. Its enterprise version adds an approval step for new MCP servers and logs each call with the user or agent behind it.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":95,"product_name":96,"url":97,"description":98},"boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"slug":108,"name":109,"problem":110,"products":111},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":130,"url":132,"description":133},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[135,141],{"slug":136,"name":137,"logo_path":138,"roles":139},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png",[140],"affected",{"slug":142,"name":143,"logo_path":144,"roles":145},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[140],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":160},"ai-coding-agents-can-be-fed-malicious-plugins-despite-version-pinning","AI Coding Agents Can Be Fed Malicious Plugins Despite Version Pinning","Plugin4Shell exposes a fundamental trust assumption flaw in AI coding agents: pinning a plugin to a specific commit hash does not guarantee integrity when Git hosting platforms allow branch names that visually mimic commit hashes. Attackers with repository owner privileges can silently substitute malicious code while the agent reports installing the expected, reviewed version — a classic software supply chain substitution attack. This matters because developers rely on version pinning as a security control, and its silent bypass can introduce backdoors or malicious payloads into codebases with no visible warning. The fact that GitHub Copilot remains unpatched and Google has declined to fix Gemini CLI leaves millions of developers exposed with no automatic remediation path.",[151,152,153,154,155,156,157,158,159],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST SSDF (SP 800-218) PW.4: Reuse Existing, Well-Secured Software","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","SLSA Framework Level 3: Provenance and Build Integrity","OWASP A08:2021 – Software and Data Integrity Failures",{}]