Muhammad Tayyab
Plugin4Shell showed SHA pinning alone can’t stop AI coding-agent plugin RCE. Here’s a practical builder checklist: versions, hosts, auto-updates, and hardening.
If you ship software with an AI coding agent in the loop, Plugin4Shell is the kind of disclosure that should change your defaults—not your roadmap slide deck.
In mid-September 2026, Air Security published research on a plugin SHA-pinning bypass affecting four major AI coding agents: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI. The firm calls it Plugin4Shell: the agent checks out the commit the marketplace pinned, but never verifies that the working tree actually landed on that commit. An attacker who controls the plugin’s Git repository can swap in malicious code while the pin still looks honored. With plugin auto-update on, that swap can land with no click and no prompt—classic supply-chain RCE with the developer’s privileges.
This post is a builder-facing checklist: what failed, what is patched as of late September 2026, and what to harden even when the pin “worked.”
SHA pinning was supposed to be the grown-up answer to plugin rug-pulls. Review the code at one commit. Lock that commit. Trust that forever after, “install” and “update” mean that snapshot—not whatever main happens to be this morning.
Air’s write-up shows the missing step was almost embarrassingly small: after git checkout, assert that HEAD equals the pinned SHA, and abort if it doesn’t. Without that check, Git’s own reference-resolution rules become the attack surface.
Researchers describe two closely related variants:
FETCH_HEAD. If the default branch is literally named FETCH_HEAD, checkout can resolve to the branch and discard the fetched commit.Neither path requires owning the marketplace. It requires controlling the plugin source repo—either by publishing something benign that later turns malicious, or by taking over a repo the marketplace already trusts (Air links this to their earlier SkillJacking / RepoJacking work).
Zero-click comes from auto-update: bump a still-benign pin in the marketplace, then rug-pull the checkout. Claude Code and Codex, per Air, auto-update installed plugins by default.
Primary source: Air Security — Plugin4Shell. Independent coverage: The Hacker News, The Register, and Cloud Security Alliance.
Status below reflects public reporting around disclosure (mid/late September 2026). Re-check vendor channels before you treat this as gospel for your fleet.
Other disclosure facts worth knowing:
Also keep the blast radius honest: The Hacker News checked default / community catalogs and found plugins pointing at GitHub-hosted repos—where the branch-name variant is blocked at the host. That does not mean you are safe if you (or your company marketplace) pull plugins from Bitbucket or a self-hosted forge, or if you still run Gemini CLI’s install path. Pinning failed as a guarantee; GitHub hosting is a mitigation for one variant.
Pinning answered the wrong question.
bbb…bbb?”bbb…bbb?”That is the same structural pattern security teams keep rediscovering one layer up or down the stack: a control inspects the identifier, while the runtime resolves something else. CSA’s research note frames Plugin4Shell exactly this way—verify the resolved artifact, not the reference you asked for.
For builders, the lesson is sharper than “update and forget”:
Treat agent plugins the way you eventually learned to treat npm packages: provenance, maintainer trust, update policy, and blast radius—not vibes.
Use this as a same-day pass for a solo founder laptop or a small engineering org. Adjust severity to how much secret material your agents can touch.
List every install of Claude Code, Codex, Copilot, Gemini CLI, and anything else that installs marketplace plugins or skills—including CI runners and shared jump boxes. Agents on a build agent with cloud keys are a different incident than agents on a sandboxed laptop.
Record versions in the same place you track runtime languages. If you do not pin the agent binary, marketplace pin theater does not matter.
For each installed plugin / marketplace:
Prefer hosts that reject SHA-shaped branch names for the first variant—and still verify HEAD yourself. Host policy is not a substitute for agent-side checks.
Before install (and again after any auto-update window):
Soft estimate, labeled as such: if your team already refuses random npm packages without review, apply at least that bar to agent plugins—the blast radius is often larger because the agent already has your shell and tokens.
Where Copilot (or any unpatched agent) still pulls plugins, turn off background auto-update if the product allows it. That does not stop a malicious install, but it removes the zero-click path Air emphasizes for Claude Code / Codex-style defaults.
After install or update, in the plugin’s Git checkout:
git rev-parse HEAD to the marketplace pin.Air’s durable fix is effectively that assertion inside the agent. Until every agent does it, you are the control.
Because public reporting does not confirm that an agent upgrade cleans already-swapped trees, reinstall critical plugins from known-good pins and re-check HEAD. Rotate any credentials the agent could have read if you have reason to suspect compromise.
Even a perfect pin does not make an evil plugin safe.
Indie hackers skip this; founders regret skipping it. One page is enough:
FETCH_HEAD path remain in the threat model.HEAD, sandbox credentials.If you are wiring AI coding agents into a product workflow—or auditing an existing setup after this disclosure—and want a practical pass on versions, plugin policy, and credential scope, you can reach out via the contact form on iamtayyab.com. No hard sell: a short conversation about whether your agent setup matches the checklist above is enough.
Muhammad Tayyab is a full stack and mobile developer. He builds consumer products under dawnapps.co, including DripScore — an AI outfit rating app on the App Store.
App Store companions now drive Claude Code, Codex, and Copilot from your phone. A builder’s checklist for E2E encryption, approvals, and multi-machine pairing.
OpenAI’s Dots keep working after chat ends. A practical builders checklist for permissions, connected apps, approval gates, and monitoring.
Meta’s Muse Mac 0-day showed how a stolen agent token can reach email, WhatsApp, camera, and linked devices. A practical trust checklist for founders.