aiVIDEO
Coding agents hit by zero-click Plugin4Shell flaw and session-hijacking PyPI attack
Plugin4Shell allows zero-click code execution in Claude Code, Codex, Copilot and Gemini CLI, while a separate attack hijacked coding sessions to plant a malicious PyPI package across about 100 repositories.
AI Will
@FinanceYF5Archived 2026.09.24Originally posted 2026.09.23
AI Will @FinanceYF5Originally posted 2026.09.23
5/ 编码Agent曝出两个安全问题。 Plugin4Shell可零点击执行代码，影响Claude Code、Codex、Copilot和Gemini CLI。 Claude Code 2.1.179和Codex 0.146.0已修复；Gemini CLI已弃用，Copilot披露时未修补。 另一起攻击劫持编码会话，植入恶意PyPI包，扩散到约100个仓库。该更新了，也该检查插件维护者。
x.com/financeyf5/status/2102661399612928337Archived 2026.09.24 11:05