StepSecurity Now Inventories AI Agent Plugins in Your GitHub Repositories and on Developer Machines

Summary

StepSecurity now inventories AI agent plugins for Claude Code and Codex, both on developer machines and in GitHub repositories. Dev Machine Guard shows installed plugins on developer machines, and a new Agent Plugins page under GitHub shows plugins that an organization's repositories publish and enable. The source frames plugins as a supply chain surface because they run code with the developer's privileges and their publisher identity in the manifest is self-declared.

Topics

• AI agents

Related items

• HighCVE-2026-116843: Mistral Vibe remote code execution via git filter driversSimilar attack · NVD/CVE Database
• MediumMalicious downloads can trick AI coding agents into compromising themselvesSimilar attack · CSO Online
• InfoSteering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply ChainSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoNameTrap: Steering AI Coding Agents Toward Security Vulnerabilities via Variable NamesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumGHSA-2wqp-q3c6-ccj5: MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsSimilar attack · GitHub Advisory Database