⤷ Title: Plugin4Shell: Zero-Click RCE Hits Four AI Coding Agents
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 21 Sep 2026 01:00:00 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI Coding Agent #AI supply chain #Claude Code #Gemini CLI #Plugin4Shell #SHA pinning #Zero_Click RCE
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 21 Sep 2026 01:00:00 +0000
════════════════════════
⌗ Tags: #Vulnerability Report #AI Coding Agent #AI supply chain #Claude Code #Gemini CLI #Plugin4Shell #SHA pinning #Zero_Click RCE
Daily CyberSecurity
Plugin4Shell: Zero-Click RCE Hits Four AI Coding Agents
TL;DR AIR Security disclosed Plugin4Shell, a zero-click remote code execution flaw in four AI coding agents. The bug defeats SHA pinning, the check meant to lock a plugin to reviewed code. Claude …