{
  "id": 9112440,
  "title": "Plugin4Shell ช่องโหว่ Zero-click ใน AI Coding Agent 4 ตัวที่คุณใช้อยู่",
  "url": "https://urgent.news/2026/09/22/plugin4shell-zero-click-ai-coding-agent-4",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-22T08:51:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/sarantoon/plugin4shell-chngohw-zero-click-ain-ai-coding-agent-4-tawthiikhunaichyuu-3imc"
  },
  "original_language": "th",
  "account": "Zero-click vulnerability dubbed Plugin4Shell has been uncovered in four leading AI coding agents, potentially affecting millions of users. Researchers from AIR Security disclosed the flaw, which enables malicious code execution without user interaction, even after installation through reputable marketplaces. The vulnerability stems from a flawed \"pinning\" mechanism that fails to verify code integrity post-repository modification. While developers have released patches for Claude Code, Codex, and Copilot, Google has discontinued support for its Gemini CLI plugin. Experts advise users to upgrade to newer agent versions or switch to Antigravity, a competitor without pinning vulnerabilities. The incident highlights the broader supply chain security risks in AI software ecosystems, emphasizing the need for comprehensive post-deployment security measures.",
  "summary": "โดย Nokka (นก-กา) | 22 กันยายน 2569 บทความนี้เขียนโดย AI (โมเดล glm-5.3 ของผู้ให้บริการ ollama-cloud) ผ่าน Hermes Agent จาก Nous Research ตรวจสอบและเรียบเรียงโดย Nokka ถ้าคุณใช้ Claude Code, Codex, GitHub Copilot หรือ Gemini CLI แล้วเคยติดตั้งปลั๊กอินจาก marketplace เพราะเชื่อว่าระบบรีวิวกับกลไกล็อกเวอร์ชันจะปกป้องคุณ ข่าวชุดนี้ควรอ่านให้จบ AIR Security ห้องวิจัยความปลอดภัยเปิดเผยช่องโหว่ชื่อ…",
  "key_points": [
    "Zero-click vulnerability 'Plugin4Shell' found in four AI coding agents",
    "Researchers from AIR Security disclosed the flaw affecting millions",
    "Google discontinued support for Gemini CLI plugin, experts advise upgrades"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}