Plugin4Shell: MSP update checklist for AI coding agents

DRAFT, defensive only. Inventory AI coding agents and plugin sources, pin supported versions and verify vendor guidance. No PoC.

Plugin4Shell: MSP update checklist for AI coding agents

Plugin4Shell describes a mismatch between a reported repository pin and materialized agent code. Inventory versions and plugin sources; apply vendor guidance without reproducing the reported trick.

Source: The Hacker News, 2026-09-18; vendor guidance is attributed there to Air Security and OpenAI Codex notes.

Pin checklist: Claude Code ≥2.1.179; Codex ≥0.146.0; Copilot has no fix stated by Air; Gemini CLI migrate to Antigravity. Prefer GitHub-hosted marketplaces where policy permits, inventory non-GitHub hosts and disable untrusted auto-update if allowed. Verify current vendor notes before rollout.

Version checks only — defensive reminders
claude --version
# Check the approved Codex package/version string
# Check Copilot and Gemini CLI versions in managed inventory

Ban: do not reproduce the Air PoC or branch-trick mechanics. Optional Auris posture: audit which tenant approved each plugin source; operational trace only, not certification.