Four AI Coding Agents Pinned Their Plugins to a Commit Hash. Nobody Checked What Arrived

Every major AI coding agent installs plugins the same way. A marketplace publishes a plugin, the agent pins it to a specific git commit, and the pin is supposed to be the guarantee. A commit hash is content-addressed; it cannot be quietly rewritten. Pinning is the standard answer to supply-chain risk in package ecosystems, and it is the reason plugin marketplaces for coding agents have been treated as a solved problem.

Researchers at AIR Security have now published a disclosure showing that all four major agents — Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI — asked git for the pinned commit and never confirmed that the pinned commit was what came back. They call it Plugin4Shell. Two of the four have shipped a fix. Two have not, and one of those is not going to.

The pin was checked. The result was not.

The flaw is not in the hash. It is in the gap between requesting a commit and verifying what the working tree actually contains afterwards. OpenAI's own fix note describes the underlying behaviour plainly: git "can interpret a requested commit SHA as a branch name," which can leave the agent holding "a different commit than the one it pinned." Where the plugin repository is hosted somewhere that permits ambiguous reference names, the owner of that repository can cause the pin to resolve to code the marketplace never reviewed.

AIR's summary of the defect is shorter:

The agent checks out the exact commit the marketplace pinned but never verifies it landed there.

The severity comes from what runs next. A coding agent holds the developer's shell, their credentials and their source tree. Code arriving inside a plugin arrives inside all of it.

Background auto-update is what makes it zero-click

Installing a plugin is a decision a developer makes once. Keeping it current is a decision the agent makes continuously, because plugins auto-update in the background by default. That is the part of the finding that should worry defenders most, and the researchers say so directly:

This is not only an install-time bug, and that is what makes it zero-click: the same git checkout re-runs on background auto-update.

A plugin vetted and installed in March can therefore be replaced in September without the developer touching anything. There is no prompt, no install step, and no moment at which a human is asked to approve the new code.

Where the patches stand

AIR says it reported the issue to all four vendors in June, after discovering it in May. No CVE identifier had been assigned as of 18 September, and none of the four has published a security advisory — meaning the channels a security team normally watches would not have surfaced this at all. The researchers report no evidence of exploitation in the wild.

GitHub says it is not exposed. That is a claim about hosting, not about agents.

GitHub's position is that the problem cannot reach its users, because it restricts what repositories on its platform may be called:

GitHub does not allow users to create branch or tag names that resemble commit SHAs... ensuring the reported vulnerability cannot be exploited on GitHub.

That is accurate as far as it goes, and it is why plugins hosted on GitHub are protected from this particular variant. The researchers' objection is that it puts the fix in the wrong layer. Copilot and other agents can install from marketplaces hosted elsewhere — Bitbucket, a self-hosted git server, an internal mirror — and none of those inherit GitHub's naming rules. As AIR put it, "the fix has to ship in the agent, and updating is the only complete mitigation."

The disagreement matters beyond this one bug. A platform-side restriction protects the users of that platform; the agent is the component that decides what to execute, and the only one present for every install from every source. Microsoft says nearly 90% of the Fortune 500 use Copilot, and part of its enterprise appeal is support for internal marketplaces — precisely the configuration GitHub's naming rule does not cover.

What to do

Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later; on both, that is the complete fix. For Copilot, there is no patch, so the available control is organisational: restrict which plugin marketplaces developers may install from, and prefer GitHub-hosted ones until Microsoft ships a change in the client. Gemini CLI is not getting a fix at all, which makes migration a security decision rather than a roadmap one.

The plugin layer around coding agents has grown faster than the machinery meant to review it. AIR's earlier work on the same ecosystem found a fake skill that cleared security review and then changed the external resource it pulled from, reaching roughly 26,000 agents before removal. Plugin4Shell is the same failure one level down: a review that happened, a pin that was recorded, and a gap between the recorded intent and what the machine ran.

Sources: AIR Security: Plugin4Shell · Help Net Security · The Register · The Hacker News