plugin4shell

AI coding-agent plugins installed through marketplace workflows can be silently replaced with attacker-controlled code under a newly disclosed flaw dubbed Plugin4Shell, and the immediate risk is uneven: Anthropic’s Claude Code 2.1.179 and OpenAI Codex 0.146.0 contain fixes, while Google has said...