Tagged: Supply Chain
1 post · browse all tags
-
Checked Out, Not Checked: Inside Plugin4Shell's Zero-Click Hit on Four AI Coding Agents
A SHA pin is supposed to mean a plugin can never silently change under you. AIR Security found that four major AI coding agents check out the pinned commit but never confirm they landed on it, and a git ref collision is enough to swap in different code while the pin still looks honored.