Security1 publisher2 min readPublished
Plugin4Shell defeats the SHA pinning that locks reviewed plugins in four AI coding agents
AIR says Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a pinned plugin commit without verifying they landed on it, so a trusted plugin can be swapped for attacker code during a background auto-update. Anthropic and OpenAI have patched.
The Watch · Security desk
What happened
- AIR says a bug it calls Plugin4Shell breaks SHA pinning, the control that locks an installed plugin to a reviewed version of its code, in Claude Code, Codex, GitHub Copilot and Gemini CLI.
- One attack path is a plugin that works as advertised, passes review and is turned malicious later; a plugin AIR built for earlier research spread to more than 26,000 agents before it was pulled.
- AIR found the flaw in May 2026 with working proof-of-concept exploits against all four agents and disclosed it to each vendor the following month.
- Google deprecated Gemini CLI instead of patching it and tells users to move to Antigravity, a newer agent built without the plugin pinning system the attack relies on.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure An attacker who lands the swap gets the same reach into company systems and data as the employee running the agent, and the victim only had to install a reviewed plugin from a marketplace they trust.
- constraint Marketplace review, allowlists and pinning policy cannot contain this, because the code that fails to verify the checkout lives in the agent; remediation is a version number from each vendor.
- decision For three of the four agents, where a plugin repo is hosted sets the exposure, so triage starts with which installed plugins point at Bitbucket or an internal git server.
- precedent A vendor can now answer a proven exploit chain by retiring the product and calling migration the fix. The exposed installs keep running until someone moves them.
Each agent runs a git checkout at the pinned SHA and then trusts the result, without confirming that the checkout landed on that commit [5]. The missing step is that one check. AIR says Claude Code, Codex and GitHub Copilot share one version of the bypass, tied to git's handling of branch names, and that Gemini CLI is exposed through a separate flaw in how it fetches and checks out pinned commits, with the same outcome [6].
The branch-name detail decides who is actually reachable. "This only works where a branch can be named like a hash. That is git's default behavior, but some hosts forbid it - GitHub rejects a 40-hex branch name outright - while others, Bitbucket among them, and any self-hosted git server, allow it," AIR wrote [8]. For those three agents, the path opens where a plugin repo sits on Bitbucket or an internal git server.
AIR wrote that "the same git checkout re-runs on background auto-update - the default in Claude Code and Codex - so when the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action" [7]. Nothing about that path requires a user to install anything. The researchers added that "the exposure is not limited to users who install plugins carelessly: the victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends" [3].
The scale numbers come from AIR's earlier work on takeovers. In the research it calls SkillJacking, AIR found 925 skills already in active use that had been hijacked from their original maintainers, reaching 134,000 agents [10]. That averages roughly 145 agents behind each hijacked skill [20]. "Together, the chain is proven end to end - takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them," AIR wrote [11].
Anthropic patched Claude Code in version 2.1.179 [14]. OpenAI patched Codex in version 0.146.0 [15]. Microsoft, told about the same flaw in Copilot, has not shipped a fix, about three months after disclosure [16][21]. AIR says the check runs inside the agent, so no marketplace can guarantee the protection on its own, and updating the agent remains the only complete fix where one exists [13].
"It is the first supply chain vulnerability of the AI agent ecosystem," the researchers said [2]. AIR's writeup ends by noting that enterprises using Air Marketplace and Air Filter, its own products, were not affected by Plugin4Shell [18].
What to watch
- Whether Microsoft ships a Copilot fix, and which version carries it.
- Whether Bitbucket or self-hosted git operators start rejecting 40-hex branch names, closing the branch-name path without an agent update.
- Whether Plugin4Shell is seen used against a real Bitbucket-hosted or self-hosted plugin repo, outside AIR's proof-of-concept.