Security firm Air Security disclosed a vulnerability named Plugin4Shell on Thursday. It affects four widely used AI coding agents and lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version.
The flaw targets the supply-chain trust between coding agents and plugin repositories. Version pinning is supposed to ensure an agent installs only code that has been reviewed, but Plugin4Shell lets a repository owner replace the pinned code, so the agent fetches something different from what was approved.
The public disclosure does not name the four affected agents. The key takeaway is that pinning alone may not protect against a malicious repository owner.