The pin that quietly slipped

If you build with AI coding agents, you probably trust marketplace plugins the way you trust a lock: review once, pin the commit, sleep better. Plugin4Shell is the story of that lock clicking shut — and opening on a different door.

Air Security disclosed the issue on September 17, 2026; The Hacker News covered it the next day. The short version: Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI can fetch a pinned plugin commit and never verify that HEAD actually matches the pin. Git can resolve a 40-hex branch name instead of the commit object, so a repo owner who controls the plugin source can swap malicious code while the pin still looks honored.

No CVE as of September 18. No known real-world exploitation. Still: if plugins sit next to your secrets, this one is worth ten quiet minutes.

What Plugin4Shell actually does

Agent plugins inherit the same reach you have — files, tokens, internal tools. Marketplaces try to contain that risk with SHA pinning: review commit aaa…, pin it, and assume every later install lands on that exact tree.

Plugin4Shell breaks the last step. Agents clone and check out the pinned SHA, but they skip the obvious assertion:

test "$(git rev-parse HEAD)" = "<pinned-sha>" || abort

Without that check, git’s own ambiguity rules become the attack surface. When a name is both a valid ref and an object id, git prefers the ref (with a warning you will never see in an agent log). An attacker who already got a benign plugin reviewed can later:

  1. Ship a routine, still-benign pin bump.
  2. Create a branch named exactly like the new 40-hex pin and make it the default branch.
  3. Point that branch at malicious content.

On agents with background plugin auto-update (default on Claude Code and Codex for their built-in marketplaces), that swap can land with zero clicks — no reinstall prompt, nothing to notice.

A second path is takeover: hijack a trusted author’s repo (Air previously demonstrated SkillJacking / RepoJacking at scale), then ride Plugin4Shell past the pin that was supposed to contain the rug-pull.

Who is patched — and who is not

AgentStatus (per Air / THN)What to do

Anthropic Claude Code

Fixed in 2.1.179+

Update now

OpenAI Codex

Fixed in 0.146.0+

Update now

GitHub Copilot

No patch yet

Extra caution on non-GitHub plugin hosts

Google Gemini CLI

Won’t be patched (deprecated)

Migrate to Antigravity

Gemini’s variant is slightly different: it fetches the pin into FETCH_HEAD, then checks out FETCH_HEAD — which can resolve to a branch of that name instead of the fetched commit. Same missing rev-parse check; different costume.

The GitHub-shaped silver lining

Here is the part that matters for most creators: GitHub rejects hash-shaped branch names. The Hacker News checked default catalogs on September 18 and found Anthropic’s community catalog (and the defaults for Claude Code / Copilot) pointing at GitHub repos. That blunts the classic 40-hex branch-name trick for default marketplace installs.

Bitbucket and self-hosted git still allow those names, and the agents officially support them — so custom / enterprise marketplaces off GitHub remain the sharper edge. Auto-update is also typically on by default only for the agents’ own GitHub-hosted marketplaces; outside marketplaces are often optional/off, which further shrinks the zero-click window for careful setups.

Still update. A marketplace cannot fully enforce a client-side pin; the fix has to live in the agent.

What you should do this week

  1. Update Claude Code to 2.1.179+ and Codex to 0.146.0+ immediately.
  2. Prefer GitHub-hosted default marketplaces when you can — they reject the hash-shaped branch variant that powers the classic swap.
  3. If you must use Bitbucket / self-hosted plugin sources, treat auto-update as higher risk until your agent includes the HEAD-equals-pin check; disable risky auto-update where the product allows it.
  4. Copilot users: no vendor patch yet — avoid non-GitHub plugin remotes if you can, and watch Microsoft’s release notes.
  5. Gemini CLI users: plan the move to Antigravity; Google is not shipping a Plugin4Shell fix for the retired CLI.
  6. Remember: updating stops future swaps. Sources do not clearly say a past malicious checkout is auto-scrubbed — if you suspect exposure, reinstall plugins from trusted pins after the agent update.

Why creators should care

This is not “someone tricked me into installing malware.” It is “I did the responsible thing — review, pin, trust the marketplace — and the pin still lied.” Air frames Plugin4Shell as the first clear supply-chain miss at the distribution layer of the agent ecosystem: same design gap across four major labs.

For ArtRealmAI readers shipping with coding agents every day, the mood is not panic — it is tidy hygiene. Patch the agents that have patches. Prefer hosts that reject hash-named branches. Keep custom marketplaces on a shorter leash. Then get back to making things.

Original Sources

—Aurelia ♡