On September 17, security researchers at AIR published Plugin4Shell, a zero-click remote code execution flaw sitting inside the four most widely used AI coding agents: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI. No prompt injection, no malicious model, no user click. The bug lives in the plumbing that installs plugins, and it breaks the one guarantee developers were told they could trust.
That guarantee is SHA pinning. When a plugin passes review in a marketplace, the system locks it to a specific Git commit hash, a 40-character fingerprint of the exact code that was approved. The pin is supposed to mean “you will run this reviewed snapshot and nothing else.” AIR found that all four agents fetch the snapshot and then never confirm the code they ended up with actually matches the pin. The lock was decorative.
For anyone doing serious AI coding agent security work, this is the story worth stopping on this week, because a month after the vendors were told, two of the four still have no agent-side fix.
What actually broke
The mechanism is almost insultingly simple. Claude Code, Codex, and Copilot run a git clone followed by git checkout <pinned-sha>. An attacker who controls the plugin repository creates a branch whose name is identical to that 40-character commit hash, then sets it as the default. Git hits an ambiguous reference, prefers the branch name over the commit object, prints a “refname is ambiguous” warning that nobody reads, and checks out the attacker’s branch. The agent reports a clean install against the expected SHA while running entirely different code.
Gemini CLI has its own variant. It fetches the intended commit into .git/FETCH_HEAD, then runs git checkout FETCH_HEAD. Name the repository’s default branch FETCH_HEAD and the checkout resolves to that branch instead of the fetched commit. As AIR put it, the pinned commit “is silently discarded in favor of attacker-controlled default-branch content.”
Both paths share one root cause, in the researchers’ words: every agent “checks out the pinned commit but never checks that it actually landed there.” The fix is a single line of verification, comparing git rev-parse HEAD against the pinned SHA and aborting on a mismatch. That line was missing everywhere.
The prerequisites are worth naming, because they decide your exposure. The attacker has to control the plugin repository, either by submitting a benign plugin that passes review and swapping the contents later, or by hijacking a legitimate author’s repo. Plugin auto-update has to be on, which was the default for both Claude Code and Codex. And the branch-named-as-a-hash trick has to be allowed by the Git host. GitHub blocks branch and tag names that look like commit hashes; Bitbucket and self-hosted Git servers generally do not.
The disclosure clock that two vendors let run out
AIR discovered the flaw in May 2026 with working proof-of-concept exploits against all four agents, and disclosed to every vendor in June under coordinated disclosure. From there the responses split cleanly into two camps.
Anthropic shipped a fix in Claude Code 2.1.179 on June 17. OpenAI patched Codex 0.146.0 on August 12. Both now verify the checkout landed on the pinned commit.
The other two did not patch the code. Google confirmed on August 4 that it would not fix Gemini CLI, because the tool is being retired; its advice is to migrate to Antigravity, which does not use the same plugin architecture. Microsoft, told about the identical flaw in Copilot, has shipped no agent-side fix. GitHub told The Register that its marketplace does not permit branch or tag names resembling commit hashes, so “the attacks do not concern it.” The researchers’ rebuttal is the part that matters: Copilot plugins can live on Bitbucket and private Git servers where that block does not exist, and the pin is resolved on the user’s own machine, so no marketplace can close the hole from its side. The fix has to live in the agent. That is precisely the fix Microsoft has not written.
As of AIR’s September 18 disclosure, no CVE had been assigned, which tells you something about how new this category still is. It is being described, accurately, as the first supply chain vulnerability of the AI agent ecosystem.
Why “we reviewed the plugin” stopped being a control
The scale is the uncomfortable part. AIR estimates millions of agents across the four platforms, and The Register notes Microsoft’s own figure that nearly 90% of Fortune 500 companies use Copilot. This is not a niche developer-tool bug. It is installed inside a large share of enterprise engineering.
And the payload is total. A compromised plugin runs with the agent’s full reach: the source it can read and write, the tokens in its environment, the build system it triggers, the cloud credentials sitting in the shell. AIR’s earlier work already showed how far a poisoned extension travels once it clears review, with a single fake skill reaching roughly 26,000 agents after slipping past security scanners. Plugin4Shell removes the last speed bump, because it defeats the mechanism those scanners assumed was holding.
The lesson for buyers is not “coding agents are unsafe.” It is that marketplace review is not the control you thought you were buying. Review happens once, on the machine of whoever runs the marketplace. The pin is enforced later, on your machine, by the agent. When those two are decoupled and the agent skips the check, “it was reviewed and locked” describes a state that no longer exists by the time the code runs on your laptop. This is the same shape of failure the industry keeps rediscovering: the open-source package attacks of March 2026 and the testing environment that was less defended than production both came down to trusting a checkpoint that was never actually enforced where it mattered.
The operator’s checklist
Running network and systems operations at a large telecom for two decades taught me one durable rule about software supply chains: the control that matters is never “was this reviewed once,” it is “can I prove that what is running right now matches what I approved.” SHA pinning was supposed to be exactly that proof. Plugin4Shell is what happens when the proof is printed but never checked. So treat a coding agent for what it is, a privileged service account with an auto-updating supply chain bolted on, and constrain it accordingly.
Update first. Claude Code 2.1.179 or later and Codex 0.146.0 or later close the hole. If you cannot verify the version across your fleet, you do not know whether you are patched.
For the agents with no fix, change the blast radius, not the trust. Retire Gemini CLI as Google advises. For Copilot, restrict plugin sources to GitHub-hosted repositories, where the branch-name block still holds, and refuse marketplace plugins that resolve to Bitbucket or private Git servers until Microsoft ships an agent-side check.
Turn off plugin auto-update where the workflow can tolerate it. Auto-update is the mechanism that silently pulls the swapped code; a manual update step is a place to look.
Scope the agent like the service account it is. Least-privilege tokens with short lifetimes, no standing cloud credentials in the shell, a separate build host, and egress limits so a compromised plugin cannot quietly reach every asset the agent can touch. The same discipline that keeps a misbehaving connector or a browser agent contained applies here without modification.
And inventory what you actually run. Most organizations cannot name which coding agents and which plugins are installed across their engineering teams, which means they cannot answer whether Plugin4Shell touched them. That gap is the real vulnerability, and it predates this bug by years.
The encouraging read is that two vendors fixed a one-line omission within weeks of being told. The sobering read is that the other two decided the fix was someone else’s problem, and the mechanism everyone was trusting turned out to have never been enforced at all. On a supply chain, that is the number that should keep an operator up at night: not the exploit, but how long the lock had been open before anyone checked.