A critical security vulnerability dubbed Plugin4Shell is undermining the integrity safeguards for plugins within multiple AI coding agents. Disclosed by security firm Air Security, the flaw allows a repository owner to covertly replace the code a developer has pinned to a specific version, potentially injecting malicious payloads into AI-assisted development workflows.
The attack exploits a fundamental assumption in software development: that version tags in Git repositories are immutable. Developers commonly pin a plugin to a tag like v1.2.0 under the belief it locks the dependency to reviewed, stable code. However, because Git tags can be reassigned, a malicious or compromised repository owner can later point that same tag to a harmful commit. An AI agent verifying only the tag would then install the new, weaponized code.
The risk is severely amplified by the elevated permissions granted to AI coding assistants. These tools operate with deep system access—reading source code, executing commands, and modifying files—making a malicious plugin swap a potent vector for data theft, credential compromise, or wider system compromise.
Anthropic has patched the flaw in Claude Code version 2.1.179 and later, and OpenAI addressed it in Codex version 0.146.0. Air Security's disclosure identified four affected AI coding agents in total, though only these two plus GitHub Copilot have been named in public reporting. Copilot remains vulnerable with no patch timeline announced, leaving a significant portion of the developer ecosystem exposed. Consequently, security guidance recommends Copilot users temporarily suspend new plugin installations and audit existing ones for tampering.
The incident reveals a systemic weakness in plugin ecosystems that rely on repository-controlled references for integrity. Long-term security, experts argue, requires moving to trustless, cryptographic verification. This could involve vendors validating a content hash of the plugin code at install time, rather than relying on mutable Git tags—a shift considered critical to securing the broader AI agent supply chain.
Developers are urged to update patched agents immediately and to scrutinize their installed plugins. Plugin4Shell underscores that the powerful capabilities of AI coding tools demand equally rigorous supply chain security practices to protect the development environment.
一個名為Plugin4Shell的嚴重安全漏洞正在損害多個AI編碼代理中插件的完整性保障機制。安全公司Air Security披露，此漏洞允許儲存庫管理員秘密替換開發者已釘選至特定版本的代碼，可能將惡意載荷注入AI輔助的開發工作流程。
此攻擊利用軟件開發中的一項基本假設：Git儲存庫中的版本標籤是不可變的。開發者通常將插件釘選至如v1.2.0的標籤，相信此舉能將相依元件鎖定為經審核的穩定代碼。然而，由於Git標籤可被重新指派，惡意或遭入侵的儲存庫管理員稍後可將同一標籤指向有害提交。僅驗證標籤的AI代理隨後便會安裝被武器化的新代碼。
賦予AI編碼助手的提升權限大幅加劇了此風險。這些工具具有深度系統存取能力——讀取原始碼、執行命令及修改檔案——使惡意插件替換成為數據竊取、憑證洩露或更廣泛系統入侵的有效向量。
Anthropic已在Claude Code版本2.1.179及更高版本中修補此漏洞，OpenAI則在Codex版本0.146.0中解決問題。Air Security的披露指出共有四個受影響的AI編碼代理，但公開報告中僅提及此兩者及GitHub Copilot。Copilot仍然存在漏洞，且未公布修補時間表，導致大量開發者生態系統暴露。因此，安全指引建議Copilot用戶暫時停止安裝新插件，並審查現有插件是否遭篡改。
此事件揭示了依賴儲存庫控制的完整性參考機制的插件生態系統存在系統性弱點。專家認為，長期安全性需轉向無需信任的加密驗證。這可能涉及供應商於安裝時驗證插件代碼的內容雜湊值，而非依賴可變的Git標籤——此轉變被視為保障更廣泛AI代理供應鏈安全的關鍵。
敦促開發者立即更新已修補的代理，並仔細檢查已安裝的插件。Plugin4Shell凸顯AI編碼工具的強大功能需要同等嚴格的供應鏈安全實踐來保護開發環境。