From Dev.to
Plugin4Shell: a Git ref-resolution bug let attackers bypass SHA-pinning in 4 AI coding agents
Plugin marketplaces for AI coding agents sell one specific promise: a plugin is reviewed once, pinned to an exact Git commit hash, and whatever runs later is exactly that reviewed code. Security firm...