// ChatgptHIGH
AIR Security disclosed Plugin4Shell, a zero-click remote code execution vulnerability affecting four major AI coding agents including OpenAI Codex, GitHub Copilot, Claude Code, and Google Gemini CLI. The flaw bypasses SHA-pinning verification, allowing repository owners to silently swap trusted plugins for malicious ones that auto-install without user interaction. This represents a novel supply-chain attack vector in AI agent ecosystems where agents verify pinned commits but fail to confirm their actual deployment, enabling silent code injection.
// Get alerts for Chatgpt