AINewsnow

Plugin4Shell: a Git ref-resolution bug let attackers bypass SHA-pinning in 4 AI coding agents

Plugin marketplaces for AI coding agents sell one specific promise: a plugin is reviewed once, pinned to an exact Git commit hash, and whatever runs later is exactly that reviewed code. Security firm Air's "Plugin4Shell" finding, disclosed September 17-18, 2026, showed that promise broke in four ma…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-11-13 12:15 · DEV Community — AI
    Plugin4Shell: a Git ref-resolution bug let attackers bypass SHA-pinning in 4 AI coding agents

More stories

  1. Jensen Huang resigns as Nvidia CEO amid spy and affair scandal, roiling AI trade — CSET Georgetown
  2. Google launches Gemini 4 Hydrogen, a faster successor to Gemini 3.8 Flash — Google AI Blog
  3. Alice Huang-linked firms invested in DeepSeek and supplied banned Nvidia Blackwell chips, reports say — Financial Times AI
  4. Anthropic launches IPO targeting $1.4 trillion valuation — AP News
  5. Google opens pre-orders for Gemini-powered smart glasses with Warby Parker and Samsung — Google AI Blog
  6. Global Microsoft 365 outage disrupts Outlook, Teams and Copilot for over 12 hours — Euronews Next
  7. EU leaders gather in Dublin for bloc's first AI summit — Reuters AI
  8. Democratic political group launches new push to shape AI agenda ahead of 2028 — AP News

Get the daily brief of stories like this at 6:30 every morning →