The lead
A pinned plugin could be swapped silently in Claude Code, Codex, Copilot and Gemini CLI
The flaw is zero click: the victim only needs a plugin from a trusted marketplace, pinned exactly as the security model says. Vendors were told in June, and two of the four still have no fix three months later.
AIR researchers disclosed Plugin4Shell on 18 September: a Git branch named after a plugin's 40 character commit hash made the agent install attacker code while reporting the reviewed, pinned version. Anthropic patched in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Microsoft has shipped no Copilot patch and Google deprecated Gemini CLI instead of fixing it.
SHINOMERun claude --version today and confirm 2.1.179 or later, then list the plugins installed on the machine that builds the Shinome coach app, since a plugin runs with the same access as you do.