#developer security

SHA Pinning Did Not Save the Plugin Install

Air Security's Plugin4Shell hits Claude Code, Codex, Copilot, and Gemini CLI. Two vendors patched. Copilot is disputed. AI commits still leak secrets at 2x.