> Increases the attack surface
No it doesn’t. It fork/executes the plugin in a different process AND verifies the signature. If an attacker can replace the binary and do things with it, you already have a much larger problem. Even if they do, all it does is pass JSON around, it doesn’t allow you to execute anything from within iTerm (afaik)
> It can be called by any process
It’s not like they were storing your OpenAI API keys in some encrypted format in the first place. If you’re that paranoid, you aren’t gonna be using the AI feature in the first place.
One valid concern I can think of is TCC escalation on MacOS since fork/exec is executed in the context of iTerm. I don’t know if signatures are verified before or after running but the binary probably won’t even run without being signed by a paying Apple Developer anyways.
Edit: commenting on the change, I think it was just fine as is. AI is annoying but it was off by default. Based on the author’s comments, they don’t seem to intend on pushing it in people’s face, just something fun and optional