Plugin4Shell: your SHA pin was never verified

Plugin4Shell is the first supply-chain bug that belongs specifically to AI coding agents, and the reason it works is embarrassing: SHA pinning was checked, then never verified. Researchers at AIR Security found that four major coding agents — Claude Code, Codex, GitHub Copilot and Gemini CLI — all check out a pinned commit and never confirm the checkout actually landed on it. If you let an agent auto-update its own plugins, that is a zero-click remote code execution path into whatever your agent can reach.

What actually happened

Per AIR Security's writeup and Help Net Security's coverage:

• The mechanism is a git name-resolution quirk. A 40-character hex string is a valid branch name. When an agent runs git checkout <sha> and a branch exists with that exact name, git resolves the branch ref, not the commit object. Attacker creates a branch literally named after the pinned SHA, points it at malicious code, sets it as default. The agent checks out the branch, reports a successful install against the expected SHA, and the log looks clean.
• Gemini CLI fails a second way. It fetches the correct commit and then runs git checkout FETCH_HEAD — which also resolves to a branch of that name if one exists, discarding the commit it just fetched.
• Zero-click comes from auto-update. Claude Code and Codex refresh installed plugins in the background by default. Nobody has to approve anything. The compromise arrives on a timer.
• Patch status is uneven. Anthropic fixed Claude Code in 2.1.179 (confirmed June 17, 2026). OpenAI fixed Codex in 0.146.0 (verified August 12). Microsoft has shipped no fix for GitHub Copilot. Google chose not to patch Gemini CLI at all, deprecating it and pointing users at Antigravity instead (confirmed August 4).
• The scale is already demonstrated. AIR showed the hijack chain working against 925 skills taken over from their original maintainers, reaching 134,000 agents. Earlier research had a single malicious plugin reach 26,000 agents before removal.

AIR discovered the flaw in May 2026 and disclosed to vendors in June. The research went public in mid-September — with two of the four agents still unfixed.

Why AI coding agent plugins matter for your business

A plugin inherits the developer who ran the agent. That is the whole blast radius. Not a sandbox — the actual session: local source, ~/.aws, SSH keys, .env files, the npm token, the production database URL in a config you forgot was there. An agent add-on is not a browser extension with a permission prompt. It runs as you. AIR's separate finding that roughly 27% of agent add-ons fail vetting is the base rate you are accepting when you let an agent install its own tooling.

Turn off plugin auto-update today. This is the single highest-value change in the post and it takes a minute. Auto-update is what converts a compromised upstream repo into code on your laptop with no human in the path. Pin versions, update deliberately, and read the diff on anything that touches the filesystem or network. A weekly manual update is not friction — it is the only place a human decision exists.

"Pinned" is a claim, not a guarantee, unless something verifies it. The lesson generalizes well past coding agents. Any place your build pins a dependency by hash — container digests, go.sum, lockfiles, Terraform module refs, GitHub Actions pinned to a SHA — ask what checks the hash after the fetch. Pinning that nobody validates is a comment. In your own tooling, verify with git rev-parse HEAD after checkout and fail hard on mismatch.

Vendor patch behavior is procurement data. Two vendors fixed this in weeks. One deprecated the product rather than fix it. One has shipped nothing. When you standardize a team on an agent, you are buying that response pattern, not just the model quality. Ask for the security contact and the last three advisories before you roll a tool out to ten developers — and if you are running Copilot's plugin flow or still on Gemini CLI, treat the add-ons as unvetted code today.

Sources: AIR Security: Plugin4Shell, Help Net Security.