Plugin4Shell Mocks Pinned AI Code

Here we go again with AI innovations, where four major coding agents checked commit hashes on download but utterly failed to verify that retrieved files matched them. Users relying on Claude Code, Codex, GitHub Copilot, and Gemini CLI were treated to rogue repository owners casually swapping pinned plugins for arbitrary malicious code. Protecting ourselves involves installing Anthropic and OpenAI patches, bidding farewell to Google's retired Gemini CLI, and sighing at GitHub Copilot remaining completely unfixed.