Plugin4Shell defeats the SHA pinning that locks reviewed plugins in four AI coding agents
AIR says Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a pinned plugin commit without verifying they landed on it, so a trusted plugin can be swapped for attacker code during a background auto-update. Anthropic and OpenAI have patched.
The Watch · Security desk
What happened
- AIR says a bug it calls Plugin4Shell breaks SHA pinning, the control that locks an installed plugin to a reviewed version of its code, in Claude Code, Codex, GitHub Copilot and Gemini CLI.
- One attack path is a plugin that works as advertised, passes review and is turned malicious later; a plugin AIR built for earlier research spread to more than 26,000 agents before it was pulled.
- AIR found the flaw in May 2026 with working proof-of-concept exploits against all four agents and disclosed it to each vendor the following month.
- Google deprecated Gemini CLI instead of patching it and tells users to move to Antigravity, a newer agent built without the plugin pinning system the attack relies on.
Why it matters
- Who's exposed exposure An attacker who lands the swap gets the same reach into company systems and data as the employee running the agent, and the victim only had to install a reviewed plugin from a marketplace they trust.
- What it limits constraint Marketplace review, allowlists and pinning policy cannot contain this, because the code that fails to verify the checkout lives in the agent; remediation is a version number from each vendor.
- Who has to decide decision For three of the four agents, where a plugin repo is hosted sets the exposure, so triage starts with which installed plugins point at Bitbucket or an internal git server.
- What it sets up precedent A vendor can now answer a proven exploit chain by retiring the product and calling migration the fix. The exposed installs keep running until someone moves them.
Next story · Science · Sep 23
GitHub will meter every Copilot plan by token consumption from June 1Confirmed2 publishers
Each agent runs a git checkout at the pinned SHA and then trusts the result, without confirming that the checkout landed on that commit [2]. The missing step is that one check. AIR says Claude Code, Codex and GitHub Copilot share one version of the bypass, tied to git's handling of branch names, and that Gemini CLI is exposed through a separate flaw in how it fetches and checks out pinned commits, with the same outcome [5].
The branch-name detail decides who is actually reachable. "This only works where a branch can be named like a hash. That is git's default behavior, but some hosts forbid it - GitHub rejects a 40-hex branch name outright - while others, Bitbucket among them, and any self-hosted git server, allow it," AIR wrote [6]. For those three agents, the path opens where a plugin repo sits on Bitbucket or an internal git server.
AIR wrote that "the same git checkout re-runs on background auto-update - the default in Claude Code and Codex - so when the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action" [17]. Nothing about that path requires a user to install anything. The researchers added that "the exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends" [16].
The scale numbers come from AIR's earlier work on takeovers. In the research it calls SkillJacking, AIR found 925 skills already in active use that had been hijacked from their original maintainers, reaching 134,000 agents [8]. That averages roughly 145 agents behind each hijacked skill [13]. "Together, the chain is proven end to end - takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them," AIR wrote [20].
Anthropic patched Claude Code in version 2.1.179 [9]. OpenAI patched Codex in version 0.146.0 [12]. Microsoft, told about the same flaw in Copilot, has not shipped a fix, about three months after disclosure [10][14]. AIR says the check runs inside the agent, so no marketplace can guarantee the protection on its own, and updating the agent remains the only complete fix where one exists [4].
"It is the first supply chain vulnerability of the AI agent ecosystem," the researchers said [19]. AIR's writeup ends by noting that enterprises using Air Marketplace and Air Filter, its own products, were not affected by Plugin4Shell [21].
What to watch
- Whether Microsoft ships a Copilot fix, and which version carries it.
- Whether Bitbucket or self-hosted git operators start rejecting 40-hex branch names, closing the branch-name path without an agent update.
- Whether Plugin4Shell is seen used against a real Bitbucket-hosted or self-hosted plugin repo, outside AIR's proof-of-concept.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption35
- Hype gap+40
- Incentives75
- Confidence66
Perspective Coverage
4 publishers- Builder
- Builder 41%
- Operator
- Operator 50%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The bug, dubbed Plugin4Shell by AIR, breaks SHA pinning, the mechanism developers rely on to lock an installed plugin to a specific reviewed version of its code, across Claude Code, Codex, GitHub Copilot and Gemini CLI.
- [2]
AIR's researchers found that every one of the four agents checks out the pinned commit without verifying the checkout landed there, letting an attacker swap in malicious code while the pin still looks intact.
- [3]
AIR says the vulnerability could give an attacker the same reach into a company's systems and data as the employee running the agent.
- [4]
AIR says that because the check runs inside the agent rather than at the marketplace, no marketplace can guarantee the protection on its own; each vendor must fix it in the agent, and updating remains the only complete fix wherever one exists.
- [5]
Claude Code, Codex and GitHub Copilot share one version of the SHA-pinning bypass, tied to how git handles branch names; Gemini CLI is exposed through a separate mechanism in how it fetches and checks out pinned commits, though the outcome is the same.
- [6]
AIR wrote: "This only works where a branch can be named like a hash. That is git's default behavior, but some hosts forbid it - GitHub rejects a 40-hex branch name outright - while others, Bitbucket among them, and any self-hosted git server, allow it."
- [7]
In the first attack path, an attacker publishes a plugin that works exactly as advertised, passes review and is adopted, then turns it malicious later; AIR said it has already shown this works, with a plugin it built spreading to more than 26,000 agents before being pulled.
- [8]
In the second attack path, an attacker takes over the repository behind a plugin users already trust; AIR's SkillJacking research found 925 skills already in active use had been hijacked from their original maintainers, reaching 134,000 agents.
- [9]
Anthropic patched Claude Code in version 2.1.179 following AIR's disclosure.
- [10]
Microsoft, told about the same flaw in Copilot, has not shipped a fix, leaving its users with no patch.
- [11]
AIR found the bug in May 2026, with working proof-of-concept exploits against all four agents, and disclosed it to each vendor the following month.
- [12]
OpenAI patched Codex in version 0.146.0.
- [13]
The 925 hijacked skills AIR found reached an average of roughly 145 agents each.
- [14]
About three months passed between AIR's June 2026 disclosure and the September 18, 2026 report, with no Copilot fix shipped.
- [15]
Help Net Security published its report on Plugin4Shell on September 18, 2026.
- [16]
"The exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends," AIR's researchers said.
- [17]
AIR wrote: "This is not only an install-time bug, and that is what makes it zero-click: the same git checkout re-runs on background auto-update - the default in Claude Code and Codex - so when the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action."
- [18]
Google deprecated Gemini CLI rather than patching it, so every existing install stays exposed indefinitely, and advises those users to move to its newer agent, Antigravity, built without the plugin pinning system the attack relies on.
- [19]
"It is the first supply chain vulnerability of the AI agent ecosystem," the researchers said.
- [20]
AIR wrote: "Together, the chain is proven end to end - takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them."
- [21]
AIR's researchers concluded: "Enterprises using Air Marketplace and Air Filter were not affected by Plugin4Shell."
Sources
4 independent publishers whose own reporting we read for this story.
- Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected
air.security
1 article · September 18, 2026
- helpnetsecurity.comZero-click RCE vulnerability hit four major AI coding agents, two remain unpatched
1 article · September 18, 2026
- scworld.comBacteria, Spartans, AI gone wild, Cisco, WordPress, Settra, Plugin4Shell, Josh Marpet - SWN #617
1 article · September 18, 2026
- thehackernews.comPlugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents
2 articles · September 18, 2026
Topics and entities
Topics
- Software Supply Chain Security
- AI Coding Agents
- Agent plugin marketplaces