Your SHA pin is a suggestion, not a lock You pin a plugin to a commit SHA because you did the review, you trust that exact code, and you never want it to silently change. That's the entire point of pinning. Last week, security researchers at AIR proved that four of the biggest AI coding agents ...
Source: [Dev.to](https://dev.to/ashraf_chowdury09/plugin4shell-your-ai-coding-agents-pinned-dependency-was-never-actually-pinned-32el)