Microsoft Releases AI Shell Preview 4 with Major macOS Upgrades

Microsoft has rolled out Preview 4 of its AI Shell tool, bringing key improvements, especially for macOS users. The release enhances compatibility with macOS, introduces new agent support, and expands command functionality, marking a significant step forward in AI-powered command-line experiences.



Improved macOS Integration and Sidecar Support



The most impactful change is the overhaul of the macOS sidecar experience. Previously unreliable, the feature now performs consistently when paired with iTerm2 and PowerShell 7. The update resolves limitations like the inability to run the /code post command, aligning macOS functionality with the Windows version.



Another addition is the installation script upgrade, which now installs the AI Shell module on macOS systems, simplifying setup for Mac users.



New Agent Support and Enhanced Command Features



Preview 4 introduces support for the Phi Silica agent. This model, built into Copilot+ PCs, allows offline use of AI Shell. However, it’s not bundled by default. Users must manually clone the repository and build the code. Microsoft cautions that the agent remains experimental and may not be stable in future releases.



The update also adds Entra ID authentication for Azure OpenAI instances. This means you can now authenticate without saving API keys in config files, improving security and convenience.



Microsoft has expanded the Invoke-AIShell command with new parameters. The -PostCode and -CopyCode Flags simplify interaction with the side pane, letting you post or copy code directly without using text commands. A third flag, -Exit, closes the side pane without typing /exit.



Other Notable Improvements




Support for the latest OpenAI models



/clear added as an alias for /cls



Enhanced model management in the Ollama agent




To install AI Shell Preview 4, run the following PowerShell command:



Invoke-Expression "& { $(Invoke-RestMethod 'https://aka.ms/install-aishell.ps1') }"



Check out full details on Microsoft’s official release notes and the AI Shell GitHub repository.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Microsoft Releases AI Shell Preview 4 with Major macOS Upgrades
id: b9573754-ec50-4e44-8915-77e482ede9c4
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - attack.t1059

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Microsoft Releases AI Shell Pr" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Microsoft Releases AI Shell Preview 4 wi")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Microsoft Releases AI Shell Preview 4 wi*"

CommonSecurityLog
| where Message has "Microsoft Releases AI Shell Preview 4 wi"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc