Plugin4Shell attack lets repo owners swap pinned plugin code across four AI coding agents
assentic · reddit · 2026-11-06
A Reddit post discusses Plugin4Shell, where repository owners can swap pinned plugin code across four AI coding agents, creating a supply-chain attack surface. The author asks how others scan Skills, Plugins, MCP and MODs daily, noting existing tools may not catch this class of attack.
More from coding & agent
- Gemini /teamwork agents caught live: four parallel task logs all running that second — RyanSpunk · 2026-11-13
- Codex CLI 0.168.0 adds model provider picker, side-by-side TUI workspace and animated GIF generation — github-actions[bot] · 2026-11-13
- Free MCP server lets Claude read Altium, Allegro, KiCad and Gerber PCB files directly — woodisruff · 2026-11-13
- a16z Partner Clones Open-Source Game with Fable 5.2 Agent, Which Finds Its Own Horse Animation Asset — FinanceYF5 · 2026-11-13
- OpenAI team shares how it runs and governs fleets of persistent agents internally — romainhuet · 2026-11-13
- Perplexity's Decider scanned 1B tokens across 7,000 agent sessions, found 14 security fixes — denisyarats · 2026-11-13