A branch named like a commit SHA swapped plugin code in Claude Code, Codex and Copilot

The pin is a request to git. The agents pass the pinned SHA to git checkout, according to a dev.to write-up of Air Security's May 2026 research ^[1][3]. None of them then checked that the code on disk was the commit they had asked for ^[1]. Git resolves that name in a priority order, and a branch whose name matches the SHA can come first ^[3]. So a marketplace reviews one commit, and the agent runs a branch head while proceeding as if the reviewed commit had loaded ^[3]. Air Security named the resulting zero-click remote code execution flaw Plugin4Shell ^[2].

The write-up likens the pin to Docker image digests and the checksums in Go's go.sum file ^[5]. The likeness holds for the identifier and breaks at the check. A digest protects a build only when the tool compares it against what it fetched, and that comparison is the step the agents left out ^[1]. According to the post, the fix is exactly that step: verify the checkout target after the checkout completes ^[6]. It is a small patch in the right place, and it covers the branch-collision variant that Claude Code, Codex and Copilot share ^[6]. GitHub rejects 40-character hexadecimal branch names at the host, while Bitbucket, GitLab and self-hosted git servers accept them ^[11].

Gemini CLI reaches the same outcome by another route, through FETCH_HEAD branch naming during checkout ^[10]. Deprecating the tool closes Google's ticket, and the post says it leaves existing users exposed ^[9].

I read the distribution figures the way I read a benchmark table: as a result from someone else's setup. The 26,000 agents came from one proof-of-concept plugin in a research exercise with guardrails, and the count stopped when the marketplace detected and pulled the plugin ^[12]. A real attacker would need control of a plugin repository, a marketplace pin bump to trigger updates, and targets left on default background updates ^[3][4]. The SkillJacking figures work out to about 145 agents per compromised skill ^[1]. The post does not say who ran that campaign or how the 925 skills were identified ^[13].

The post files Plugin4Shell with the supply-chain attack patterns of npm, PyPI and RubyGems ^[14]. I think the category fits. In my context, an agent plugin gets the review an npm package from an unknown author gets. Someone reads the pinned commit, and every update counts as new code until the agent runs a build that verifies its own checkout.