Plugin4Shell and the Broken Trust Model Behind AI Coding Agent Plugins

SHA pinning sounds definitive. It isn't—unless the client verifies what actually landed on disk. Plugin4Shell demonstrates exactly why that distinction matters. AIR Security identified a zero-click RC