{
  "id": 19592747,
  "title": "Plugin4Shell",
  "url": "https://urgent.news/2026/11/12/plugin4shell",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T03:25:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hamvero/plugin4shell-2dag"
  },
  "original_language": "en",
  "account": "A vulnerability dubbed Plugin4Shell has affected four major AI coding agents from different vendors. The flaw allows an attacker to replace trusted plugin code with malicious code while appearing to install the correct version. This occurs due to a missing verification step in the agents' checkout process. Researchers discovered the issue in May 2026 and provided working exploits against Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The agents in question fetch code based on a specific Git commit's SHA hash. However, they fail to verify that the code they retrieve matches the requested commit. Attackers can exploit this by creating a branch with a name identical to the pinned commit hash and making it the default branch, tricking the agents into installing the attacker's code instead. This vulnerability exposes the agents to the same permissions as the developer using them, potentially gaining access to source code, secrets, cloud environments, production systems, internal services, and enterprise data. While some vendors have patched their agents, others like Google have deprecated the affected tool (Gemini CLI) instead of providing a fix, leaving installations vulnerable. The marketplace cannot centrally fix the issue, as the verification check occurs within each agent, not at the marketplace level. Therefore, each vendor must address the vulnerability individually by updating the agents to the patched versions. Developers should also review and reduce the permissions and access granted to the agents in their environments.",
  "summary": "A plugin pinned to a reviewed commit hash should install that exact code. That assumption underpins how most organizations secure AI coding agents. In September it failed across all four major ones. The broken check The AIR Security research lab named the flaw Plugin4Shell . Researchers Or Nevo, Dor Granat, and Niv Hoffman found it in May 2026 and built working exploits against Claude Code,…",
  "key_points": [],
  "editors_take": "The failure to verify code integrity during the checkout process shifts the burden of security onto individual vendors and forces developers to manually restrict the broad permissions granted to agents.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}