Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

Security firm Air Security discovered a vulnerability in four AI coding agents that allows plugin repository owners to swap approved plugin code with malicious versions by exploiting branch naming tricks. Anthropic and OpenAI have patched the flaw, GitHub Copilot remains unpatched, and Google will not fix the Gemini CLI as it is being retired. The attack exploits insufficient verification of plugin code hashes, posing risks to user data and credentials on affected platforms like Bitbucket.