Plugin4Shell turned a pinned commit into attacker code in four AI coding agents

Pinning a plugin to a reviewed commit is the careful option. A developer reads the code, takes the SHA of that commit, and tells the agent to run that exact copy ^[4]. The gap is in what happens next: the agents pass the SHA to Git and then run whatever Git hands back, without checking that the returned commit is the one they asked for ^[5]. An attacker who controls the plugin repository can publish a version containing malicious code and name it after the legitimate commit, so Git resolves the request to the attacker's copy ^[6]. Gemini CLI reaches the same failure by a different route, fetching the correct code and then checking it out under the name FETCH_HEAD, a name the attacker can also create ^[7].

The gap sits in the client. The fix travels by agent version number, so whoever controls which version sits on a developer's machine owns whatever exposure is left. AIR wrote that Plugin4Shell is "a flaw no marketplace can fix, so users must update their agent" ^[3].

Two of the four named agents can be remediated by updating them. The other two need a migration decision or a wait ^[16].

GitHub and AIR do not agree on how much is already closed. A GitHub representative told The Register that the company has applied restrictions on creating version or tag names that resemble commit SHAs, preventing the reported vulnerability from being exploited on GitHub or on plugins from its marketplace ^[12]. AIR researchers told the same publication that those naming restrictions might not be enough, because plugin marketplaces can also be hosted on other platforms, such as Bitbucket ^[13]. Pareekh Jain, principal analyst at Pareekh Consulting, said that gap, together with the likelihood that enterprises running affected agents have not yet patched, could leave development environments exposed through compromised plugins ^[14]. Jain said enterprises using AI coding agents with third-party plugins "are likely to be most exposed" ^[15].

No one has published an attack on this. AIR describes the flaw, the disclosure and the vendor fixes, and does not describe any instance of exploitation in the wild ^[18]. Then there are the dates. The flaw was found in May and reached the vendors in June ^[8]. That is at least a month of shipped agents carrying it before the vendors knew, and longer before any fix existed ^[17]. For this quarter, the practical test is whether a firm can say today which agent versions its developers are running and which hosts their plugins come from.