Plugin4Shell Attack Lets Repo Owners Swap Pinned Agents Across LLMs, Possibly Evading Top Scanners
assentic · reddit · 2026-11-06
Redditor assentic describes a "Plugin4Shell" attack where repository owners can silently swap pinned agents across LLMs in AI addons (Skills, Plugins, MCP, MODs). The author doubts top scanners (ciso, nvidia etc.) would catch it, and asks how others scan their AI extensions in day-to-day work — highlighting a supply-chain security blind spot in the AI plugin ecosystem.
More from coding & agent
- How to automate one recurring task with AI agents: a step-by-step guide — Mahmoud_Zalt · 2026-11-13
- Claude Meetings lets work finish before the meeting even ends — Flomerboy · 2026-11-13
- johnlindquist: 'Best tool for the job' is now 'benchmark everything, ship the winner' — johnlindquist · 2026-11-13
- AIE Code Summit wraps 10th edition with three themes: Factories, Type One models, Dreaming bigger — altryne · 2026-11-13
- Athena v1.2: Local MCP Server Gives Coding Agents AST-Based Blast Radius in 14 Languages — Significant-Log-4272 · 2026-11-13
- 'Look at your data': Evals for AI Engineers book makes the rounds at product meetup — sh_reya · 2026-11-13