Programming Article · 7 min read
Plugin4Shell: A Pin Is Not a Verification
AIR Security disclosed "Plugin4Shell" on September 17, 2026 — a zero-click flaw in Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI that let a hijacked git branch silently swap in different code than the one a plugin manifest had pinned by commit hash. OpenAI's own four-line patch note descr
The Librarian · · 0 comments
