#copilot
2 published articles
Plugin4Shell: SHA-pinning bypass hits Claude Code, Codex, Copilot, and Gemini CLI
Air Security (17 Sep 2026) reports a zero-click RCE path where agents check out a pinned plugin commit but do not verify the working tree. Anthropic and OpenAI shipped patches. Google deprecated Gemini CLI without a fix. Microsoft/GitHub Copilot: no patch as of the report.
Copilot agents split on declarative vs custom engine before Control System gates
Microsoft docs: declarative agents inherit M365 compliance; custom engine agents bring your own orchestrator and hosting bill.