Plugin4Shell Bypasses SHA Pinning Across All Four Major AI Coding Agents

AIR Security disclosed Plugin4Shell, a zero-click remote code execution vulnerability that bypasses SHA pinning in four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and the Gemini CLI. Anthropic patched Claude Code in version 2.1.179 and OpenAI fixed Codex in version 0.146.0, but GitHub Copilot remains unpatched and Google has deprecated the Gemini CLI, advising users to migrate to Antigravity instead of issuing a fix. The flaw exploits git's resolution of branch names over commit hashes, letting an attacker who controls a plugin repository create a branch named identically to the pinned 40-hexadecimal commit SHA and set it as default, so the agent silently checks out malicious code while believing it runs the pinned version.

The security of the AI agent ecosystem has long relied on a simple, foundational assumption: if you pin a specific version of a plugin using a cryptographic hash, you are guaranteed to run that exact code. Plugin4Shell https://air.security/blog-posts/plugin4shell proves that this assumption is fundamentally broken. Discovered by the AIR Security https://air.security research lab, Plugin4Shell is the first true supply-chain vulnerability to hit the AI agent ecosystem. Unlike previous security research that focused on manipulating the model or the agent itself, this attack targets the distribution layer – the marketplaces and repositories that feed code to millions of machines. It is a high-severity, zero-click remote code execution vulnerability that affects four of the most prominent AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and the Gemini CLI. The deeper issue is how these agents handle version control. When an agent installs a plugin, it typically performs a git checkout using a pinned 40-hexadecimal commit SHA to ensure integrity. However, the affected agents fail to verify that the resulting working tree actually matches that specific hash. If an attacker controls the plugin’s repository, they can create a branch with a name identical to the pinned SHA and set it as the repository’s default. Because git resolves branch names over commit hashes, the agent silently checks out the attacker’s malicious branch instead of the intended commit. The agent believes it is running the secure, pinned version, while the working tree is actually under the attacker’s control. This is a zero-click exploit because of how modern agents manage updates. Claude Code and Codex, for instance, run background auto-updates that re-execute the checkout process. When a marketplace bumps a pinned SHA, the agent automatically pulls the new version. If an attacker has already staged their malicious branch, the swap happens in the background without any user interaction or notification. The vulnerability is effectively invisible to the end user. The patch status across the industry is uneven. Anthropic patched Claude Code in version 2.1.179, and OpenAI addressed the flaw in Codex version 0.146.0. However, GitHub Copilot remains unpatched, leaving users exposed. Google has opted to deprecate the Gemini CLI entirely, advising users to migrate to Antigravity rather than issuing a fix. Because the verification failure occurs inside the agent itself, marketplaces are powerless to enforce the security guarantees they advertise. The fix must be implemented within the agent software, making updates the only viable path to mitigation. Plugin4Shell is the third act in a narrative AIR Security has been building. Their previous work demonstrated how easily malicious skills could go viral and seize control of over 26,000 agents, and how attackers do not even need to plant malicious code – they can simply hijack existing, legitimate repositories. This follows earlier supply-chain incidents we have covered, including the LiteLLM breach https://forkast.news/the-package-registry-layer-how-supply-chain-attacks-are-targeting-agent-infrastructure/ and Sentry MCP SSRF https://forkast.news/sentry-mcp-server-ssrf-exposes-how-agent-trust-chains-become-attack-vectors/ , which highlighted vulnerabilities in package registries and agent trust chains. Plugin4Shell represents the failure of the boundary itself. The industry’s answer to plugin trust was SHA pinning, but Plugin4Shell shows that pinning is only as strong as the verification logic that follows it. The fix is technically straightforward: after checkout, the agent must resolve the actual commit in the working tree and abort if it does not match the pinned SHA. Until that check is universal, the distribution layer of the agent economy remains a significant, unaddressed attack surface.