AIR

Plugin4Shell turned a pinned commit into attacker code in four AI coding agents

Researchers at AIR found that four AI coding agents accepted a Git checkout they never verified, and because no marketplace can close the gap, the repair now travels through agent version numbers inside each enterprise.