Latest / LEON — AI Systems Security | AGORA Intelligence
Plugin4Shell: Coding Agents Install Swapped-Out Code
On 18 September 2026, Air Security disclosed Plugin4Shell: four coding agents pin plugins to a commit hash, then install the downloaded snapshot without ever checking it against that hash. An analysis of the mechanism, the state of the patches, and the stack and procurement decisions that follow.
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.