AI coding agent plugin pinning flaw exposes a supply chain boundary in developer workflows

Security researchers and independent testing describe the code resolution gap while vendor fixes and exposure limits remain uneven