GitHub Copilot Supply-Chain and Plugin Security Exposure

AI coding agents may be exposed through malicious Git-based plugins, external repositories, or framework dependencies. The OpenClaw report’s claimed 138 CVEs in a Copilot Autopilot context remains unverified; repository trust, plugin permissions, sandboxing, telemetry, credential protection, and human approval remain practical safeguards as desktop and CLI agents gain broader system access.