What changed
Air Security publicly disclosed Plugin4Shell on September 17, 2026 after coordinated vendor disclosure beginning in June. The affected clients accept a marketplace plugin pinned to a Git commit SHA, but can resolve a conflicting Git ref and fail to verify that the resulting checkout actually landed on the pinned commit. An attacker who controls or later hijacks a trusted plugin repository can therefore serve different code while the marketplace still appears to enforce the reviewed SHA. Air says Claude Code and Codex have shipped client fixes, while Microsoft had not shipped a Copilot fix at disclosure and Google told the researchers the deprecated Gemini CLI would not be patched.
Why it matters
Plugin marketplaces are becoming a software distribution layer for coding agents, and those plugins inherit the agent's access to source trees, credentials, terminals and internal services. SHA pinning is supposed to turn a reviewed plugin version into an immutable trust boundary. If the client does not verify the post-checkout commit, downstream review and marketplace controls can give operators a false guarantee. Background plugin updates make the consequence sharper: an already-installed, previously benign plugin can change without a fresh install or approval step.
The pin can say one thing while Git checks out another
The flaw sits in client-side Git resolution. A marketplace records a reviewed commit SHA, but an attacker controlling the plugin repository can introduce a conflicting ref so checkout resolves to attacker-controlled code. The affected agents did not reliably verify the resulting HEAD against the marketplace pin.
Auto-update can remove the final user interaction
Air reports that installed plugins can update in the background, including by default in Claude Code and Codex. That means the attacker does not necessarily need to persuade a victim to install a new malicious plugin: compromise or control of an already-trusted plugin repository can be enough to deliver the replacement code.
The fixes are split across vendors
Air says Anthropic fixed Claude Code in 2.1.179 and OpenAI fixed Codex in 0.146.0. At public disclosure, the researchers said Microsoft had not shipped a Copilot client fix. Google had deprecated Gemini CLI and told Air it would not patch that client, recommending migration to Antigravity.
This is distinct from repository-triggered agent exploits
GitSpawn and similar findings abuse configuration inside a project a coding agent opens. Plugin4Shell instead targets the agent's extension-distribution path: code that has already passed marketplace review and appears pinned can be replaced upstream. The common lesson is that agent security depends on ordinary developer-tool plumbing outside the model's visible approval loop.