Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

A vulnerability has been discovered in four popular AI coding agents, allowing an attacker who controls a plugin's code repository to replace a pinned plugin with a malicious one. This can occur even if the agent has locked the plugin to a specific reviewed version. The issue has been patched by Anthropic in Claude Code version 2.1.179 and by OpenAI in Codex version 0.146.0. However, GitHub Copilot has not patched the flaw. The security firm Air Security disclosed the vulnerability, which affects the ability of the AI coding agents to ensure the integrity of installed plugins.