Plugin4Shell breaks SHA pinning in 4 AI coding agents

Pinning a plugin to a commit SHA was supposed to be the end of the conversation

You pin a plugin to a 40-character commit hash, you review that commit once, and you move on — that pin is permanent, unless you go back and change it. That was the assumption behind SHA pinning in AI coding agents, and it turns out to have been false in every major implementation. Air Security's research disclosed a vulnerability called Plugin4Shell on September 17–18, 2026: a zero-click remote code execution bug that lets an attacker substitute malicious code for a pinned plugin while the pin still looks intact.

It affects four agents at once — Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI — which is what makes this the story of the week rather than a routine CVE in one tool. Security outlets from Help Net Security to The Register to TheHackerNews ran the disclosure within the same day, and the framing across all of them is consistent: this is the first supply-chain vulnerability that belongs squarely to the AI-agent era, because it exploits the exact mechanism agents added to make plugins feel safe.

How the pin actually breaks

In Claude Code, Codex and Copilot, the bug comes down to a checkout that nobody double-checks. The agent tells git to check out a specific 40-character commit SHA, but it never verifies that the resulting working tree actually matches that hash. An attacker who controls (or compromises) the plugin repository can create a branch whose name is identical to the target SHA string. Git will resolve that branch name in place of the real commit, and the agent — having asked for "that SHA" and gotten something back — has no way to tell the difference, according to Help Net Security's reporting.

Gemini CLI fails a slightly different way, but lands in the same place. It fetches the pinned commit and then runs git checkout FETCH_HEAD, which can resolve to a branch of that name instead of the commit itself, letting an attacker substitute code from the default branch. Two different implementation paths, one shared root cause: a checkout that succeeds is treated as proof the pin held, when it is nothing of the sort.

That shared root cause is the part Air Security wants practitioners to sit with. This was not one team's sloppy code review — the same trust assumption was built independently into every affected agent: checkout succeeded, therefore the pin held. Four separate engineering organizations reached for the same shortcut and none of them added the one line of verification that would have closed it.

Why "zero-click" is the scary part

The exploit needs no phishing link, no malicious flag, no approval dialog. Because Claude Code and Codex both auto-update installed plugins by default, a victim only has to already have a plugin installed from a marketplace they reviewed correctly at install time. The attacker's job is to compromise the plugin's repository state later and wait for the next automatic sync — no separate action from the user, no social engineering, nothing to click.

That timeline matters. Air Security found the bug in May 2026, built working proof-of-concept exploits against all four agents, and disclosed to every vendor in June 2026 under coordinated disclosure before going public in September. Three months of lead time is a normal, generous coordinated-disclosure window — and two of the four vendors still shipped nothing by the time it went public.

Where each vendor actually stands

This is the detail that turns Plugin4Shell from "patch and move on" into a live decision practitioners have to make today:

Anthropic shipped a fix in Claude Code 2.1.179. Help Net Security confirms this — update and you're covered.
OpenAI shipped a fix in Codex 0.146.0, per the same reporting. Update and you're covered.
Microsoft has not shipped a patch for GitHub Copilot as of disclosure. There is no version number to jump to.
Google has deprecated Gemini CLI outright rather than patch it, pointing users toward Antigravity instead. Every existing Gemini CLI install is permanently exposed, by design — there will be no fix to wait for.

That last bullet is worth pausing on. "Deprecated" is not "patched," and treating it as equivalent is exactly the false confidence Plugin4Shell is about. An install that stays on Gemini CLI because migrating is inconvenient is carrying an unpatched zero-click RCE indefinitely.

What to do about it this week

If you run Claude Code or Codex with any third-party plugins installed, check your version now. Claude Code needs to be at 2.1.179 or later, Codex at 0.146.0 or later. If you're behind either, update before you next let auto-update run silently — you want to control the timing, not just the outcome.

If you run GitHub Copilot with plugins from any marketplace other than a fully closed, self-hosted one, treat every installed plugin as unverified until Microsoft ships a fix. There is nothing to update to yet, so the only mitigation is reducing what you trust: pull plugins you don't strictly need, and avoid auto-sync settings that let a compromised upstream repo push new code into your environment unattended.

If you're still on Gemini CLI, the honest answer is that there is no patch coming. Migrate to Antigravity if the workflow lets you, or accept — explicitly, as a documented decision, not a default — that you're running a tool with a known zero-click RCE that Google will not fix.

And if you're building your own agent plugin system — internal tooling, a custom marketplace, anything that pins dependencies to a commit — do not assume "we pin to a SHA" is a security control on its own. Plugin4Shell exists because a checkout that returns successfully was treated as proof the pin held. Add an explicit step after checkout that computes the tree hash and compares it against the pinned commit's actual tree, and fail closed if they don't match. That one check is the difference between a pin that's enforced and a pin that's theater — and right now, four of the biggest names in AI coding agents had shipped the theater version.