Plugin4Shell Breaks AI Agent Plugin Pins

Plugin4Shell can let repository control on vulnerable Git hosts swap code behind a supposedly pinned plugin in major AI coding agents, potentially inheriting the user’s files, credentials, and system access. Update Claude Code and Codex, and restrict unpatched plugin sources or auto-updates.