#vulnerability-disclosure

Developer Tools

Plugin4Shell breaks SHA pinning in four AI coding agents at once

A shared design flaw lets attackers swap pinned plugin code in four major AI coding agents without any user action. Two vendors still have no fix.

18 September 20265 min read