Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
- Agent add-ons - the plugins and skills you install into an AI agent - are effectively applications, and enterprises overwhelmingly install them from open community marketplaces rather than a vetted, enterprise-grade one.
- The agent runs with the full capabilities of the employee operating it: the same access to sensitive data, internal systems, and production environments.
- Plugins inherit those permissions by default.
Unverified
- Agent add-ons - the plugins and skills you install into an AI agent - are effectively applications, and enterprises overwhelmingly install them from open community marketplaces rather than a vetted, enterprise-grade one.
- The agent runs with the full capabilities of the employee operating it: the same access to sensitive data, internal systems, and production environments.
- Plugins inherit those permissions by default.
Sources: Air