Plugin4Shell: One Missing Check Broke SHA Pinning Across Every Major AI Coding Agent

If you pin a plugin to a specific reviewed commit hash, you get that exact code. That assumption underpins how basically every organization secures AI coding agents — and as of yesterday, it’s broken across all four major ones.

What actually broke

The vulnerability, dubbed Plugin4Shell by the AIR Security research lab, defeats SHA pinning in Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. Researchers Or Nevo, Dor Granat, and Niv Hoffman found it in May 2026 with working proof-of-concept exploits against all four agents, disclosing to each vendor the following month.

The mechanics are almost embarrassingly simple, which is what makes it worth understanding. In a normal secure workflow, a marketplace or your security team reviews a plugin at a specific Git commit and records that commit’s SHA hash. The agent is then supposed to fetch exactly that reviewed code.

The affected agents request the pinned SHA during Git checkout, but never verify that the checked-out working tree actually corresponds to it. That gap opens the door to Git reference-name ambiguity: an attacker creates a branch whose name is the same 40-character hexadecimal string as the pinned commit, sets it as the repository’s default branch, and Git may resolve the branch name instead of the commit hash. The agent installs attacker-controlled code while reporting a successful install of the trusted, pinned version.

One missing verification step, and the entire pinning guarantee evaporates.

Why “zero-click” and why it matters

Several coding agents automatically update previously installed plugins. That’s what makes this zero-click: an attacker can publish a benign plugin, pass marketplace review legitimately, wait for adoption, then swap the code later. The victim does nothing wrong and takes no action.

Worth quoting the researchers’ framing directly, because it cuts against the usual “users install sketchy things” excuse: the exposure isn’t limited to people who install plugins carelessly. The victim only has to have a plugin installed — from a marketplace they trust, reviewed and pinned exactly as the security model intends.

The blast radius follows from what these plugins can reach. AI agent plugins, skills, and extensions typically run with the permissions of the developer operating the agent: source code, secrets, cloud environments, production systems, internal services, enterprise data. An attacker gets the same reach as the employee running the agent.

AIR calls it the first true supply-chain vulnerability of the AI agent ecosystem, and that label holds up. Prior agent security research mostly targeted the model or the agent’s own reasoning. This targets the distribution layer — the marketplaces feeding code to millions of machines.

The patch situation is genuinely uneven

This is where it gets practical, and where the four vendors diverge sharply:

• Claude Code — patched by Anthropic in version 2.1.179
• Codex — patched by OpenAI in version 0.146.0
• GitHub Copilot — Microsoft was told about the same flaw and has not shipped a fix. Users have no patch available.
• Gemini CLI — Google deprecated it entirely rather than patching, advising migration to Antigravity. Every existing install stays exposed indefinitely.

That last one deserves sitting with. Deprecation is not remediation. An install that still runs on a developer’s machine doesn’t stop being vulnerable because the vendor stopped supporting it — it just stops being the vendor’s problem. If you have Gemini CLI installed anywhere, migrating off it is now a security task, not a roadmap item.

Why no marketplace can fix this for you

The tempting assumption is that GitHub, or whichever marketplace you use, will handle it centrally. AIR is explicit that this isn’t possible: since the verification check runs inside the agent rather than at the marketplace, no marketplace can guarantee the protection on its own. Closing the gap requires each vendor to fix it in the agent itself.

Practically, that means updating is the only complete fix wherever one exists — and where it doesn’t exist (Copilot, Gemini CLI), there is no configuration you can apply on your end that restores the pinning guarantee.

What to actually do

• Update Claude Code to 2.1.179+ and Codex to 0.146.0+ now. These are the two cases where a real fix exists, so there’s no reason to be running anything older.
• Treat Gemini CLI installs as an active migration task. No patch is coming. Ever.
• For GitHub Copilot, assume pinning is not currently a control you have. Adjust what you let it reach accordingly until Microsoft ships something — that means reviewing what secrets and production access are available in environments where it runs, rather than relying on plugin review to hold the line.
• Audit which plugins are actually installed across your team’s agents. A pinned plugin from a trusted marketplace was the exact scenario that fails here, so “we only install reviewed plugins” isn’t the reassurance it sounds like.

The broader pattern this fits

This is the second time in a month that the AI agent ecosystem’s security model has failed at the same structural layer. Earlier in September, the GitSpawn flaw let malicious .git/config files silently execute code across Claude Code, Codex, Cursor, and four other agents — with four vendors still unpatched at a September 1 retest. Before that, we covered how MCP servers get granted broad permissions with minimal vetting, and the sandbox isolation failures that let test-environment agents reach live systems.

The common thread isn’t any single bug. It’s that the tooling ecosystem around agents matured much faster than the verification infrastructure underneath it. Plugin marketplaces, SHA pinning, and approval layers all existed here — they just weren’t actually enforced end to end. That’s a much harder class of problem than a single CVE, and it’s worth assuming more of these are coming rather than treating each one as an isolated incident.

Official reference: AIR Security’s Plugin4Shell disclosure (air.security), cross-checked against Help Net Security, The Register, and GBHackers reporting from September 17-18, 2026. Patch versions cited are current as of publication and worth re-verifying against each vendor’s release notes before relying on them.