[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd0Zu7nT4_zZxSCq_wBcKtGHdmRGsePORZEcYAls14Es":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"83b011b9-1664-4739-8e3d-689c61542403","ai-coding-agents-can-be-fed-malicious-plugins-despite-version-pinning","6128f6ae-6d95-456d-ade3-058e942f1959","AI Coding Agents Can Be Fed Malicious Plugins Despite Version Pinning","Plugin4Shell exposes a fundamental trust assumption flaw in AI coding agents: pinning a plugin to a specific commit hash does not guarantee integrity when Git hosting platforms allow branch names that visually mimic commit hashes. Attackers with repository owner privileges can silently substitute malicious code while the agent reports installing the expected, reviewed version — a classic software supply chain substitution attack. This matters because developers rely on version pinning as a security control, and its silent bypass can introduce backdoors or malicious payloads into codebases with no visible warning. The fact that GitHub Copilot remains unpatched and Google has declined to fix Gemini CLI leaves millions of developers exposed with no automatic remediation path.","**Immediate actions:**\n- Audit all AI coding agent plugin configurations and temporarily disable third-party plugin loading until patches are confirmed applied.\n- Validate that plugin commit hash references resolve to cryptographically verified objects (e.g., using `git cat-file`) rather than branch name look-alikes.\n- Apply available patches for Anthropic and OpenAI coding agents immediately and monitor GitHub Copilot advisories for an upcoming fix.\n\n**Long-term improvements:**\n- Enforce cryptographic signing (e.g., Sigstore\u002Fcosign) for all plugins consumed by AI coding agents so tampering is detectable regardless of hash spoofing.\n- Implement a vetted internal plugin registry that mirrors approved, integrity-checked plugin versions rather than pulling directly from public repositories.\n- Establish a formal policy requiring security review of all AI agent extensions before use in production or CI\u002FCD pipelines.\n\n**Detection measures:**\n- Configure code review pipelines and SAST tools to flag unexpected changes introduced by AI agent plugin installations as part of every pull request.\n- Enable runtime integrity monitoring to alert when installed plugin file hashes diverge from expected values recorded at approval time.\n- Log all plugin resolution events from AI coding agents centrally so anomalies (e.g., hash mismatches, unexpected network fetches) can be detected and investigated.",[12,13,14,15,16,17,18,19,20],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST SSDF (SP 800-218) PW.4: Reuse Existing, Well-Secured Software","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","SLSA Framework Level 3: Provenance and Build Integrity","OWASP A08:2021 – Software and Data Integrity Failures",{},"published","2026-09-18T14:21:40.012655+00:00","2026-09-18T14:21:39.704+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fplugin4shell-lets-repository-owners.html","plugin4shell-lets-repository-owners-swap-pinned-plugin-code-across-four-ai-codin-68651e","Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":37,"name":38,"slug":39,"description":40,"color":41},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[44,48,52],{"slug":45,"name":46,"problem":47},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":49,"name":50,"problem":51},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",{"slug":53,"name":54,"problem":55},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]