Plugin4Shell: The SHA-Pinning Flaw That Exposed Four AI Coding Agents

Four of the most widely used AI coding agents shipped with the same trust flaw: a mechanism that let any plugin repository owner silently replace pinned, supposedly-reviewed code with whatever they wanted, and the agent would run it without a word of warning. The vulnerability, called Plugin4Shell by the Air Security researchers who discovered it, was publicly disclosed on September 17, 2026. No exploitation in the wild has been reported — but the window for GitHub Copilot users is still open.

What SHA Pinning Is Supposed to Do

When you install a plugin into an AI coding agent, most tools let you pin it to a specific commit hash — a 40-character SHA-1 string that uniquely identifies one specific snapshot of the plugin's code. The contract is clear: the plugin author can push new commits all day, but if your config says a7f3d2c1…, you're running a7f3d2c1…. That's the whole point of hash pinning. It's the same principle behind locking package-lock.json or pinning Docker image digests.

Plugin4Shell breaks that contract at the Git layer, in a way that's subtle enough that four separate engineering teams at four separate companies all missed it.

The Mechanism: A Branch Named Like a Hash

Git resolves symbolic references — branch names, tags — before it resolves raw commit objects. If a repository contains a branch whose name is the exact 40-character string that matches a pinned commit hash, Git will follow the branch reference instead of fetching the commit object. The affected agents performed the checkout but never verified that the code in the resulting working tree actually matched the expected hash. The agent reports the pin is honored. The code that runs belongs to the attacker's branch.

To pull this off, an attacker needs control of the plugin's repository and the ability to create a branch with a hash-like name — nothing more. Because AI coding agent plugins are routinely sourced from public repositories on GitHub and Bitbucket, that describes any plugin author. The execution is zero-click: no developer interaction required, no reinstall, no approval prompt. Code runs at the privilege level of the coding agent, which typically means access to the local filesystem, environment variables, SSH keys, and whatever cloud credentials happen to be in scope.

Who Is Affected and What's Patched

Air Security researchers Or Nevo, Dor Granat, and Niv Hoffman found the same flaw — independently implemented — in all four agents they tested. The vendors were notified in June 2026, giving roughly three months of private remediation time before publication. Here's where things stand:

• Claude Code (Anthropic): Patched in version 2.1.179, which shipped before public disclosure. Run claude --version to check. Any installation older than 2.1.179 is vulnerable.
• Codex (OpenAI): Patched in version 0.146.0.
• GitHub Copilot: No patch available as of the September 17 disclosure date. Microsoft has not announced a fix timeline. Copilot users with third-party plugins installed remain exposed.
• Gemini CLI (Google): No patch, and Google has stated it will not release one. The tool is being retired in favor of Antigravity. Existing installations remain vulnerable indefinitely.

No CVE number has been assigned at time of writing.

Why Four Teams Built the Same Blind Spot

The uncomfortable part of Plugin4Shell isn't that one team made a mistake — it's that four separate teams, working independently, all made the same one. They each verified that the checkout command completed successfully. None of them verified that the code on disk matched the hash they'd checked out to. The assumption was: if Git says we're on that commit, we must be on that commit. In the common case, that's true. In the adversarial case, it isn't.

Git's branch-before-commit reference resolution behavior is documented, but it surfaces rarely in normal development workflows. The combination of AI-native plugin ecosystems, rapid feature iteration, and SHA pinning as a relatively new security primitive created a gap nobody was looking into — until Air Security looked.

What Developers Should Do Right Now

• Update Claude Code to 2.1.179 or later. Verify with claude --version. Push the update to CI runners and shared dev environments, not just your local machine.
• Update Codex to 0.146.0 or later. Same logic: audit pipelines and shared installations.
• Audit your Copilot plugins. Until Microsoft ships a fix, treat every plugin sourced from a public repository as unverified external code. Disable any plugin you don't actively need.
• Stop using Gemini CLI. Google has confirmed no patch and is sunsetting the product. Migrate to Antigravity or another supported tool.
• Inventory your plugin sources. For every AI coding agent in use, document which plugins are installed, which repositories they pull from, and whether those repos are under your organization's control. Third-party public repos are the attack surface.
• Watch for the CVE assignment and fold it into your patch tracking once it lands.

AI Tooling Is Inheriting an Old Problem

Plugin4Shell is a supply chain attack in the same family as typosquatting, dependency confusion, and malicious npm packages — just wearing different clothes. Package ecosystems like NPM and PyPI have spent years developing mitigations: hash verification, package signing, software bills of materials. AI agent plugin systems are roughly at the starting line of that same journey.

The near-term risk isn't a sophisticated nation-state operator. It's a developer who installed a plugin from a public repository months ago, pinned it to a reviewed commit, and moved on. That developer's workstation — with its cloud credentials, private keys, and access to production — is the target. At Falcon Internet, we've seen this same trust-once, forget-forever pattern cause real damage in PHP package ecosystems; periodic verification of what's actually running beats one-time pinning every time.