Vulnerability

Plugin4Shell

Name given to a plugin SHA-pinning bypass in AI coding agents, in which an agent checks out a pinned git commit without verifying which commit it landed on.

Known aliases

plugin SHA-pinning bypass

Current stories

securityConfirmed4 publishers

Plugin4Shell defeats the SHA pinning that locks reviewed plugins in four AI coding agents

AIR says Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a pinned plugin commit without verifying they landed on it, so a trusted plugin can be swapped for attacker code during a background auto-update. Anthropic and OpenAI have patched.

Publishers:air.security helpnetsecurity.com scworld.com thehackernews.com

Perspective Coverage

4 publishers

Builder: Builder 41%
Operator: Operator 50%
Investor: Investor 9%

Reality

Evidence70
Adoption35
Hype gap+40
Incentives75
Confidence66

buildOne report1 publisher

A branch named like a commit SHA swapped plugin code in Claude Code, Codex and Copilot

Air Security found four coding agents skipped checking plugin code against its pinned commit SHA, a gap one test plugin used to reach 26,000 agents. Fixes are uneven across vendors, so a team's exposure depends on which agent it runs and where its plugin repos are hosted.

Publishers:dev.to

Reality

Evidence35
Adoption: Not scored
Hype gap+40
Incentives: Not scored
Confidence35

buildOne report1 publisher

Plugin4Shell uses default plugin auto-update to run attacker code past SHA pins in four coding agents

Plugin4Shell lets attacker code replace SHA-pinned plugins in Claude Code, Codex, Gemini CLI and Copilot through default auto-update, with no prompt. A pin only protects you if the agent checks fetched code against the hash, so agent plugins need the same review as any other dependency.

Publishers:dev.to

Reality

Evidence25
Adoption: Not scored
Hype gap+35
Incentives70
Confidence25

productOne report1 publisher

A fake branch name defeats the commit pin four AI coding agents rely on

Air Security's Plugin4Shell lets a plugin be swapped during a background refresh while the agent reports the audited commit. Anthropic and OpenAI have patched, Copilot has no fix, and Google is retiring Gemini CLI.

Publishers:thenextweb.com

Reality

Evidence60
Adoption65
Hype gap+20
Incentives70
Confidence58

leadershipOne report1 publisher

Plugin4Shell turned a pinned commit into attacker code in four AI coding agents

Researchers at AIR found that four AI coding agents accepted a Git checkout they never verified, and because no marketplace can close the gap, the repair now travels through agent version numbers inside each enterprise.

Publishers:csoonline.com

Reality

Evidence62
Adoption38
Hype gap+18
Incentives60
Confidence55

buildOne report1 publisher

Four AI coding agents check out a pinned commit without confirming where the tree landed

In AIR's Plugin4Shell research, a branch named after the hash you pinned wins the checkout in Claude Code, Codex, Copilot and Gemini CLI. The check that would catch it is one line of git, run on your disk.

Publishers:dev.to

Reality

Evidence34
Adoption27
Hype gap+45
Incentives58
Confidence33