AI

Plugin4Shell Cracked the Security Promise of Four AI Coding Agents With a Git Trick

By Omar aka Crypt0 · Sep 27, 2026

The plugin marketplace was the industry’s answer to a scary year. After waves of malicious skills and hijacked agent plugins, the fix everyone agreed on was SHA pinning, which locks each plugin to one exact, reviewed commit, and the code underneath you stays put. On September 17, researchers at AIR showed the pin functioned as a label while the verification step stayed absent. They called it Plugin4Shell, and it touched Claude Code, OpenAI Codex, GitHub Copilot, and Google’s Gemini CLI in one stroke.

The mechanism is almost elegant. All four agents install plugins by checking out the pinned commit from the plugin’s git repository. An attacker who controls that repository creates a branch whose name is the exact 40 character commit hash and makes it the default branch. Git resolves a matching reference name before the commit object, so the checkout lands on the attacker’s branch while the install log still shows the trusted hash. The plugin a developer installed and the code that ran were different, and nothing in the install path noticed. The missing step is one comparison of the checked out code against the pin, and all four agents shipped with that step absent.

What gives the exploit its reach is auto update. Claude Code and Codex refresh plugins in the background by default, so a marketplace pin bump becomes a silent install event. You install something legitimate, reviewed, and correctly pinned, and the ground shifts under it later. Everything happens in silence. The update arrives on its own, past every prompt and approval, as a routine background refresh. AIR’s researchers, Or Nevo, Dor Granat, and Niv Hoffman, built working exploits in May, told the vendors in June, and published in September, with The Register covering the disclosure the same day.

The vendor scorecard, as of this week, splits four ways. Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in 0.146.0, whose release notes carry the line “Verify Git plugin SHA checkouts.” For Copilot, GitHub points to its own platform rule, telling The Register that github.com rejects SHA shaped branch names; AIR’s answer is that marketplaces live on other hosts too, Bitbucket and self hosted servers among them. Google has retired Gemini CLI in favor of Antigravity, with migration as the only path, so every existing install stays exposed.

The deeper lesson is the one worth sitting with. Four teams, four codebases, one identical assumption, that checking out a commit is the same as verifying you got it. That is a pattern, and a sign that the security model around agentic coding tools is still catching up to how much access those tools hold, your files, your repos, your cloud credentials, your SSH keys. A pin is a reference the consumer has to resolve and then verify, and every review process built on top inherits whatever the client does with it.

For builders, the fix is one assertion inside the agent, comparing the resolved HEAD against the pin after every install and update. For everyone else, the takeaway is simpler. The tools with the most access deserve the most scrutiny, and the researchers who probe them are doing the whole ecosystem a favor. Update Claude Code and Codex, turn off background plugin auto update where you can, and treat every plugin install as code running with your privileges. The pin is trustworthy again only where the check actually runs.

Sources

• Denny Sentinel: The Pin Was a Label, Not a Check
• AI Weekly: AIR Discloses Plugin4Shell
• CyberSecAsia: Zero Click Flaw in Four Coding Agents

New to crypto? Read the crypto glossary, browse frequent questions, read our story, or explore the story archive.