- What changed
- Air Security researchers disclosed a vulnerability named Plugin4Shell that bypasses version locks in four major AI coding agents using a git trick.
- Why you should care
- AI coding agents are vulnerable to version lock bypasses, exposing workflows to compromised plugin versions.
- Your move
- Watch. Monitor agent dependency controls and vendor patches.
- What to watch next
- Vendor security advisories and patch rollouts addressing the Plugin4Shell vulnerability in AI coding agents.
- Event
- security incident
- Event date
- Sep 21, 2026
- Relevant to
- General AI readers
