Plugin4Shell Bypasses SHA Pinning Across All Four Major AI Coding Agents
AIR Security disclosed Plugin4Shell, a zero-click remote code execution vulnerability that bypasses SHA pinning in four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and the Gemini CLI. Anthropic pat…