Unexpected Process Execution from AI Coding Agent Plugin Directory

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•2

Detects unexpected child processes spawned from directories associated with AI coding agent plugins (e.g., Claude Code, Copilot, Codex, Gemini CLI). This activity could indicate post-exploitation behavior, such as Plugin4Shell, where a malicious plugin auto-update facilitates remote code execution.