Omer Cheema(@Omercheema):What doesnt kill us makes us stronger. Plugin4Shell hits major coding agents. SHA-pinning on Claude Code, Codex, Gemini CLI and Copilot: a hijacked or swapped plugin can auto-update into remote code execution. Anthropic and OpenAI patched; Google will not patch deprecated Gemini CLI (migrate to Antigravity); Microsoft/GitHub dispute impact. https://t.co/Mjqvqihdkh Researchers used Claude to reach OpenAI’s private code: Hacktron used a cyber-special Claude Opus build to exploit an OpenAI Discourse image bug, stole auth tokens that also worked on employee ChatGPT and GitHub, and opened a harmless PoC PR. OpenAI paid a $6,500 bounty.

2026.09.18 09:46

What doesnt kill us makes us stronger. Plugin4Shell hits major coding agents. SHA-pinning on Claude Code, Codex, Gemini CLI and Copilot: a hijacked or swapped plugin can auto-update into remote code execution. Anthropic and OpenAI patched; Google will not patch deprecated Gemini CLI (migrate to Antigravity); Microsoft/GitHub dispute impact. Researchers used Claude to reach OpenAI’s private code: Hacktron used a cyber-special Claude Opus build to exploit an OpenAI Discourse image bug, stole auth tokens that also worked on employee ChatGPT and GitHub, and opened a harmless PoC PR. OpenAI paid a $6,500 bounty.