build1 publisher
A branch named like a commit SHA swapped plugin code in Claude Code, Codex and Copilot
Air Security found four coding agents skipped checking plugin code against its pinned commit SHA, a gap one test plugin used to reach 26,000 agents. Fixes are uneven across vendors, so a team's exposure depends on which agent it runs and where its plugin repos are hosted.
Publishers:dev.to
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+40
- Incentives
- Insufficient
- Confidence35