Plugin4Shell Hit 26,000 Agents Before Anyone Noticed. Your Coding Agent’s Plugin Store Is the New npm.
This story is from 2026-09-27. It is preserved in the archive; the latest stories are on the live feed.
A zero-click RCE vulnerability across Claude Code, Codex, Copilot, and Gemini CLI proves that AI coding agent plugin marketplaces have inherited every supply chain attack pattern from package managers, plus some new ones. In May 2026, researchers at Air Security discovered that every major AI codin…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-09-27 15:49 · DEV Community — AI
Plugin4Shell Hit 26,000 Agents Before Anyone Noticed. Your Coding Agent’s Plugin Store Is the New npm.