Plugin4Shell Attack Lets Repo Owners Swap Poisoned Code Across AI Coding Agents

A Reddit user disclosed the "Plugin4Shell" attack, in which repository owners can silently swap pinned plugin code across four AI coding agents including Claude Code and Cursor, exposing a new supply-chain attack surface for AI coding tools.

2026-11-06 ~ 2026-11-06 · 2 related posts

• Plugin4Shell attack lets repo owners swap pinned plugin code across four AI coding agents — assentic · 2026-11-06

1 near-duplicate retellings: assentic