Plugin4Shell breaks the SHA-pinning check four AI coding agents use to verify a plugin update -- two vendors still have no fix

AIR Security disclosed Plugin4Shell on September 18 -- a zero-click remote-code-execution flaw in the plugin-verification logic shared by four AI coding agents: Anthropic's Claude Code, OpenAI's Codex, Microsoft's GitHub Copilot, and Google's Gemini CLI. Each one lets a developer pin a third-party plugin to a specific, reviewed commit by its 40-character SHA -- the entire point being that the agent installs exactly that code and nothing else. AIR's researchers found the check has a hole: "the agent checks out the exact commit the marketplace pinned but never verifies it landed there."

For Claude Code, Codex and Copilot, the bypass is a naming trick: an attacker creates a Git branch named identically to the pinned commit's own SHA and sets it as the repository's default. Git resolves an ambiguous reference to a matching branch name before the raw commit object during checkout, so the agent silently lands on the attacker's branch while still reporting the pin as honored -- the SHA it asked for and the SHA it logged appear to match. Gemini CLI fails a different way: its installer fetches the correct commit, then runs `git checkout FETCH_HEAD` to land on it, and a repository branch literally named `FETCH_HEAD` redirects that checkout to whatever the attacker put there instead.

That GitHub mitigation is narrower than it sounds. It stops the exploit only on repositories GitHub itself hosts, by refusing to let a branch use a 40-character hex name -- it does not touch Copilot's own verification code, and AIR notes plugin marketplaces hosted on Bitbucket or a self-hosted Git server aren't covered at all. Anthropic's own public changelog for version 2.1.179, the release AIR credits with the fix, meanwhile, doesn't itemize a security fix by name -- ordinary practice for a silently patched vulnerability, but it means AIR's claim can't be independently confirmed against a vendor advisory, only against AIR's own retest. OpenAI's own fix landed in Codex 0.146.0, per AIR's retest.

It's the third distinct trust-boundary bypass reported against this category of tool in 2026's second half. A GitHub-issue exploit chain reached full RCE through a comment field in August, and GitSpawn, disclosed two weeks before Plugin4Shell, used a repository's own `.git/config` to run code before any approval prompt. None of the three share a root cause. What they share is where the trust breaks: not in the model's own judgment, but in a verification step underneath it that assumed Git would behave exactly the way the agent's authors expected.