// Microsoft 365HIGH
Plugin4Shell is a zero-click remote code execution vulnerability affecting GitHub Copilot and other AI coding agents. The flaw exploits Git reference name ambiguity to allow attackers to replace SHA-pinned plugins with malicious code without user interaction. Microsoft had not released a patch for Copilot at disclosure; organizations should update supported agents and audit installed plugins.
// Get alerts for Microsoft 365