The vulnerability enables the installation of plugin code that differs from the version reported as pinned. Attackers who control a plugin repository can slip malicious code into software "skills" after users have already downloaded them, impacting 4 leading AI coding agents.

The discovery of the flaw, identified as Plugin4Shell, underscores security risks as workers rely more heavily on AI agents and third party tools. The attack requires an attacker to have control of the plugin repository to force the agent to install code that contradicts its pinned version.