# Plugin4Shell breaks SHA-pinned plugin trust across major AI coding agents Air Security found a shared plugin-installation flaw across Claude Code, Codex, Copilot and Gemini CLI: a marketplace can pin reviewed code to a Git SHA while the client still checks out attacker-controlled content. Auto-updates turn that trust failure into a potential zero-click supply-chain compromise. The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed. - Status: Active - Published: 2026-09-19T10:08:23+12:00 - Updated: 2026-09-19T10:08:23+12:00 - Categories: Artificial Intelligence, Web Development, AI Agents, AI Coding, Developer Tools - Tags: Claude Code, Codex, Coding agents, Gemini, GitHub Copilot, supply chain security - Canonical HTML: https://beyondthe.news/dossiers/plugin4shell-ai-coding-agent-plugin-sha-pinning-zero-click-rce ## What changed Air Security publicly disclosed Plugin4Shell on September 17, 2026 after coordinated vendor disclosure beginning in June. The affected clients accept a marketplace plugin pinned to a Git commit SHA, but can resolve a conflicting Git ref and fail to verify that the resulting checkout actually landed on the pinned commit. An attacker who controls or later hijacks a trusted plugin repository can therefore serve different code while the marketplace still appears to enforce the reviewed SHA. Air says Claude Code and Codex have shipped client fixes, while Microsoft had not shipped a Copilot fix at disclosure and Google told the researchers the deprecated Gemini CLI would not be patched. ## Why it matters Plugin marketplaces are becoming a software distribution layer for coding agents, and those plugins inherit the agent's access to source trees, credentials, terminals and internal services. SHA pinning is supposed to turn a reviewed plugin version into an immutable trust boundary. If the client does not verify the post-checkout commit, downstream review and marketplace controls can give operators a false guarantee. Background plugin updates make the consequence sharper: an already-installed, previously benign plugin can change without a fresh install or approval step. ## The pin can say one thing while Git checks out another The flaw sits in client-side Git resolution. A marketplace records a reviewed commit SHA, but an attacker controlling the plugin repository can introduce a conflicting ref so checkout resolves to attacker-controlled code. The affected agents did not reliably verify the resulting HEAD against the marketplace pin. ## Auto-update can remove the final user interaction Air reports that installed plugins can update in the background, including by default in Claude Code and Codex. That means the attacker does not necessarily need to persuade a victim to install a new malicious plugin: compromise or control of an already-trusted plugin repository can be enough to deliver the replacement code. ## The fixes are split across vendors Air says Anthropic fixed Claude Code in 2.1.179 and OpenAI fixed Codex in 0.146.0. At public disclosure, the researchers said Microsoft had not shipped a Copilot client fix. Google had deprecated Gemini CLI and told Air it would not patch that client, recommending migration to Antigravity. ## This is distinct from repository-triggered agent exploits GitSpawn and similar findings abuse configuration inside a project a coding agent opens. Plugin4Shell instead targets the agent's extension-distribution path: code that has already passed marketplace review and appears pinned can be replaced upstream. The common lesson is that agent security depends on ordinary developer-tool plumbing outside the model's visible approval loop. ## Key details - Air Security disclosed Plugin4Shell publicly on September 17, 2026 after reporting it to affected vendors in June. - The researchers report the same SHA-pinning trust failure across Claude Code, OpenAI Codex, Copilot/GitHub Copilot and Gemini CLI plugin flows. - The client can fail to verify that the checked-out plugin HEAD equals the marketplace-pinned commit. - A repository owner or attacker who hijacks the plugin repository can potentially replace previously reviewed plugin code. - Background plugin auto-update can make the replacement zero-click for an already-installed plugin. - Air reports Claude Code 2.1.179 and Codex 0.146.0 as patched. - At disclosure Air reported no shipped Copilot fix and said deprecated Gemini CLI would not receive one. - The researchers describe the issue as a client-side trust failure, so marketplace policy alone cannot provide the complete fix. ## Builder takeaways - Update Claude Code and Codex beyond the versions Air identifies as fixed before relying on marketplace SHA pins. - Inventory coding-agent plugins and the repositories they originate from; an old trusted install is part of the attack surface when auto-update is enabled. - For unpatched clients, treat marketplace review and SHA pinning as insufficient controls and consider disabling automatic plugin updates or plugin use until a verified client-side fix exists. - Agent and marketplace developers should verify the actual checked-out commit after Git resolution rather than assuming a requested SHA proves the working tree identity. - Enterprise agent governance should treat plugins and skills as executable software supply-chain dependencies with the same provenance and update controls applied to packages and CI actions. ## What to watch - Whether Microsoft ships and documents a Copilot/GitHub Copilot client-side fix. - Whether Google provides any mitigation path for remaining Gemini CLI installations beyond migration. - Whether other agent plugin clients share the same Git-ref resolution pattern. - Whether marketplaces add stronger repository-host restrictions or signed plugin artifacts in addition to client-side checkout verification. - Any evidence of Plugin4Shell exploitation against real plugin repositories. ## Uncertainties - Air Security is the primary technical source and also sells agent-security products; its technical claims should be distinguished from its marketing claims. - No cited source establishes widespread real-world exploitation at publication. - Vendor patch status can change quickly after coordinated disclosure, particularly for Copilot. - The exact affected plugin flows and defaults differ by agent, so operators should verify their own client version and marketplace configuration. ## Sources - [Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected](https://www.air.security/blog-posts/plugin4shell) — Air Security · primary security research · 2026-09-17T00:00:00+12:00. Primary disclosure for the cross-vendor SHA-pinning bypass, exploit model, vendor-response timeline and reported fixed versions. - [AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom](https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335) — The Register · specialist/independent · 2026-09-17T00:00:00+12:00. Independent security reporting on the disclosure, affected agents, practical impact and vendor patch split.