What if an AI coding agent verifies the request for a specific commit, but never verifies the code it actually checked out?
That is the core issue behind Plugin4Shell.
AIR Security disclosed a zero-click RCE affecting Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.
The interesting part isn't a clever prompt. It's Git.
An attacker-controlled repository can exploit reference resolution so that a supposedly pinned plugin resolves to malicious code instead.
In the article, I break down both attack variants, the different implementation paths across the four agents, current patch status, and a practical hardening checklist for engineering teams.
The bigger lesson: AI agent security increasingly extends into the software supply chain.
Read the full technical breakdown:
https://neuralcoretech.com/plugin4shell-ai-coding-agents-security/
Top comments (0)