The AI industry already knew attackers could poison plugin marketplaces. Its answer was to lock every plugin to one reviewed version of its code. That lock is what just broke.
Source: [TNW](https://thenextweb.com/news/plugin4shell-ai-coding-agents-zero-click-rce-sha-pinning)