AINewsnow

Plugin4Shell and NIST IR 8587, days apart: what actually authorizes an AI agent’s action?

This story is from 2026-09-20. It is preserved in the archive; the latest stories are on the live feed.

Two things landed within days of each other, and together they outline a gap I keep running into. Plugin4Shell (AIR Security, disclosed Sept 17) is a zero-click RCE affecting Claude Code, Codex, GitHub Copilot and Gemini CLI. The mechanism is almost boringly simple: marketplaces pin a plugin to a r…

Read the full story at r/artificial ↗

Timeline · 1 report

  1. 2026-09-20 12:53 · r/artificial
    Plugin4Shell and NIST IR 8587, days apart: what actually authorizes an AI agent’s action?

More stories

  1. What's your proudest side-project made with Claude? — r/ClaudeAI
  2. Cancelled my gemini.pro subscription — r/GeminiAI
  3. Opus 5.5 scores 11 points higher than 5.6 sol on AA index — r/ChatGPT
  4. Are AI agents ready for the enterprise? — r/AI_Agents
  5. What underrated AI tools have actually made you more productive in 2026? — r/LocalLLaMA
  6. Is Gemini Pro actually on par with Claude for daily tasks, or am I prompting it wrong? — r/GeminiAI
  7. Small, simple, slow LLM to write some bash. — r/LocalLLM
  8. What are the best AI tools by category right now? — r/PromptEngineering

Get the daily brief of stories like this at 6:30 every morning →