Plugin4Shell Flaw Bypasses Version Locking in Four AI Coding Agents
A newly disclosed vulnerability lets repository owners slip malicious plugin configurations past version constraints in Cursor, GitHub Copilot, Windsurf, and Continue, raising supply-chain concerns as AI coding agents spread through enterprise development.
Plugin4Shell Flaw Bypasses Version Locking in Four AI Coding Agents
Security researchers have disclosed a vulnerability dubbed Plugin4Shell that allows repository owners to bypass the version locking mechanisms of four mainstream AI coding agents. According to the disclosure, attackers can plant malicious plugin configurations in a repository, causing the agent to execute unintended code when pulling dependencies and thereby breaking the originally set version constraints.
The affected agents include tools such as Cursor, GitHub Copilot, Windsurf, and Continue. At the core of the vulnerability is insufficient trust verification of plugin sources by the agents, which lets repository owners inject arbitrary versions or malicious packages without the user's knowledge.
The research team has submitted reports to the relevant vendors, some of which say they are working on fixes. There is currently no evidence that the vulnerability has been exploited in the wild, but given the rapid adoption of AI coding agents in enterprise development environments, its supply-chain security risks warrant attention.
Source: https://news.google.com/rss/articles/CBMidkFVX3lxTFByWDdvbFNxSUNwOFc5SzU4c2tTd2dFZjZITGxONEViN3BEdWNHck9yMmNwbi10dkNQYXU5VmtyenNjMjVCVTdwS1JFUXRnT0Z4Z1pmWEEzVjZURlRoa0NMVndaM19XZmlHdWNZVEJlX1BpWVR2T3c?oc=5
Provenance & status
- Byline
- OceanAlt Editorial
- First published
- 2026-09-19
- Last updated
- 2026-09-19
- Content type
- Newsflash
- Source material
- View original ↗
Related reading
Visa and Mastercard Join Ant International on a KYA Interoperability Framework as Agent Identity Standards Begin to Converge
Félix Raises $200M Led by a16z: Stablecoin Infrastructure Shifts from Remittances to Agent Economy Settlement
U.S. Congress Holds First Hearing on AI Agent Payment Rules: Authorization, Settlement, and Identity Take Center Stage
Paste a payee address before you pay and see whether it's on a sanctions list, through a mixer, or tagged for fraud.
This judgement can sit inside your own product
One line of code; it touches neither your CSS nor your JS. The same pre-settlement judgement can appear in your articles, on your wallet's confirmation screen, or as an endpoint your agent calls before it pays.