cd /news/ai-agents/flaw-in-ai-coding-agents-exposes-use… · home › topics › ai-agents › article
[ARTICLE · art-133766] src=osintsights.com ↗ pub= topic=ai-agents verified=true sentiment=↓ negative

Flaw in AI Coding Agents Exposes Users to Plugin Swaps

A newly discovered flaw dubbed Plugin4Shell lets attackers swap out a plugin installed by an AI coding agent with malicious code, enabling file reads, credential theft, and account compromise. The vulnerability was found in all four major AI coding agents, and the affected vendors have been notified.

by read1 min views1 publishedSep 18, 2026

A newly discovered flaw, dubbed Plugin4Shell, allows hackers to swap out a plugin installed by an AI coding agent with malicious code, putting users at risk of having their files read, credentials stolen, and accounts compromised. This vulnerability was found in all four major AI coding agents, and the affected vendors have been notified.

source & further reading
osintsights.com — original article Threat Actor Exploits LLM to Craft PhantomRaven npm Stealer China Develops AI to Refine Global Propaganda Tactics AI Agents Expose New Attack Vectors
── more in #ai-agents 4 stories · sorted by recency
── more on @plugin4shell 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/flaw-in-ai-coding-ag…] indexed:0 read:1min 2026-09-18 · —