<MT />
Back to Blog
securityai-agentssupply-chaindevops

Plugin4Shell: What the AI Coding-Agent RCE Means for Your Setup

T

Muhammad Tayyab

September 24, 2026·14 min read
Dark computer monitor and keyboard on a desk — security and terminal coding vibe

Plugin4Shell showed SHA pinning alone can’t stop AI coding-agent plugin RCE. Here’s a practical builder checklist: versions, hosts, auto-updates, and hardening.

If you ship software with an AI coding agent in the loop, Plugin4Shell is the kind of disclosure that should change your defaults—not your roadmap slide deck.

In mid-September 2026, Air Security published research on a plugin SHA-pinning bypass affecting four major AI coding agents: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI. The firm calls it Plugin4Shell: the agent checks out the commit the marketplace pinned, but never verifies that the working tree actually landed on that commit. An attacker who controls the plugin’s Git repository can swap in malicious code while the pin still looks honored. With plugin auto-update on, that swap can land with no click and no prompt—classic supply-chain RCE with the developer’s privileges.

This post is a builder-facing checklist: what failed, what is patched as of late September 2026, and what to harden even when the pin “worked.”

What Plugin4Shell actually broke

SHA pinning was supposed to be the grown-up answer to plugin rug-pulls. Review the code at one commit. Lock that commit. Trust that forever after, “install” and “update” mean that snapshot—not whatever main happens to be this morning.

Air’s write-up shows the missing step was almost embarrassingly small: after git checkout, assert that HEAD equals the pinned SHA, and abort if it doesn’t. Without that check, Git’s own reference-resolution rules become the attack surface.

Researchers describe two closely related variants:

  1. Branch named like the pin (Claude Code, Codex, Copilot). The agent clones and checks out a 40-character commit hash. If the repository owner creates a default branch with that exact hex name, Git can prefer the branch over the commit object when the name is ambiguous. The reviewed commit may still exist in the object store; what ends up on disk is whatever the branch points at.
  2. `FETCH_HEAD` collision (Gemini CLI). Gemini’s install path fetches the pin, then checks out FETCH_HEAD. If the default branch is literally named FETCH_HEAD, checkout can resolve to the branch and discard the fetched commit.

Neither path requires owning the marketplace. It requires controlling the plugin source repo—either by publishing something benign that later turns malicious, or by taking over a repo the marketplace already trusts (Air links this to their earlier SkillJacking / RepoJacking work).

Zero-click comes from auto-update: bump a still-benign pin in the marketplace, then rug-pull the checkout. Claude Code and Codex, per Air, auto-update installed plugins by default.

Primary source: Air Security — Plugin4Shell. Independent coverage: The Hacker News, The Register, and Cloud Security Alliance.

Who was affected — and what is patched (~2026-09-24)

Status below reflects public reporting around disclosure (mid/late September 2026). Re-check vendor channels before you treat this as gospel for your fleet.

  • Claude Code (Anthropic) — Air reports a fix in 2.1.179 (vendor confirmation to Air dated around 2026-06-17). Action: run 2.1.179 or later. Note: Anthropic’s public release notes for that version do not appear to call out Plugin4Shell by name; the patch account comes from Air / secondary reporting.
  • Codex (OpenAI) — Fixed in 0.146.0 (Air verified around 2026-08-12). OpenAI’s own fix language, as quoted by The Hacker News, acknowledges that Git “can interpret a requested commit SHA as a branch name,” so a plugin source can materialize a different commit than the one pinned. Action: run 0.146.0 or later.
  • GitHub Copilot (Microsoft) — As of disclosure, Air and multiple outlets report no client-side fix shipped. GitHub told The Register that Plugin4Shell cannot be exploited on GitHub because GitHub rejects branch/tag names that resemble commit SHAs. Air’s counterpoint: agents also support marketplaces on hosts that allow those names (e.g. Bitbucket, self-hosted Git), so host policy alone is not a full agent fix.
  • Gemini CLI (Google) — Google told Air it will not patch; the product is deprecated in favor of Antigravity, which Air says this attack does not reach (no marketplace plugin SHA-pinning path to bypass). Enterprise residual Gemini CLI access is a separate question—do not assume it is fixed unless Google says so.

Other disclosure facts worth knowing:

  • No CVE had been assigned as of 2026-09-18 (The Hacker News).
  • No vendor security advisories were found by THN on that date.
  • THN reported no public evidence of real-world exploitation as of mid-September.
  • It is unclear whether upgrading an agent removes a plugin that was already swapped, or only stops future swaps—so treat “update and walk away” as incomplete.

Also keep the blast radius honest: The Hacker News checked default / community catalogs and found plugins pointing at GitHub-hosted repos—where the branch-name variant is blocked at the host. That does not mean you are safe if you (or your company marketplace) pull plugins from Bitbucket or a self-hosted forge, or if you still run Gemini CLI’s install path. Pinning failed as a guarantee; GitHub hosting is a mitigation for one variant.

Why SHA pinning failed as a guarantee

Pinning answered the wrong question.

  • It answered: “Did we request commit bbb…bbb?”
  • It did not answer: “Is the tree we are about to execute actually bbb…bbb?”

That is the same structural pattern security teams keep rediscovering one layer up or down the stack: a control inspects the identifier, while the runtime resolves something else. CSA’s research note frames Plugin4Shell exactly this way—verify the resolved artifact, not the reference you asked for.

For builders, the lesson is sharper than “update and forget”:

  • Marketplace review is a point-in-time snapshot.
  • A pin without post-checkout verification is a label, not an integrity check.
  • Auto-update turns a future rug-pull into background RCE for every machine that already trusted the plugin.

Treat agent plugins the way you eventually learned to treat npm packages: provenance, maintainer trust, update policy, and blast radius—not vibes.

Practical security checklist for your setup

Use this as a same-day pass for a solo founder laptop or a small engineering org. Adjust severity to how much secret material your agents can touch.

1. Inventory agents (and where they run)

List every install of Claude Code, Codex, Copilot, Gemini CLI, and anything else that installs marketplace plugins or skills—including CI runners and shared jump boxes. Agents on a build agent with cloud keys are a different incident than agents on a sandboxed laptop.

2. Pin (upgrade) agent versions where patches exist

  • Claude Code → ≥ 2.1.179
  • Codex → ≥ 0.146.0
  • Copilot → no agent fix reported yet; compensate with policy below
  • Gemini CLI → plan migration off; do not wait for a Plugin4Shell patch

Record versions in the same place you track runtime languages. If you do not pin the agent binary, marketplace pin theater does not matter.

3. Inventory the Git host behind every plugin

For each installed plugin / marketplace:

  • Host: GitHub, GitLab, Bitbucket, self-hosted, other?
  • Who can push?
  • Is auto-update on?
  • What commit does the marketplace claim to pin?

Prefer hosts that reject SHA-shaped branch names for the first variant—and still verify HEAD yourself. Host policy is not a substitute for agent-side checks.

4. Treat marketplace plugins like npm dependencies

Before install (and again after any auto-update window):

  • Read the repo; skim install hooks and shell wrappers.
  • Prefer plugins with narrow scope over “does everything” mega-skills.
  • Require a human approval step for new marketplaces (especially non-default ones).
  • Keep a short allowlist; delete what you do not use.

Soft estimate, labeled as such: if your team already refuses random npm packages without review, apply at least that bar to agent plugins—the blast radius is often larger because the agent already has your shell and tokens.

5. Disable plugin auto-update where you cannot patch

Where Copilot (or any unpatched agent) still pulls plugins, turn off background auto-update if the product allows it. That does not stop a malicious install, but it removes the zero-click path Air emphasizes for Claude Code / Codex-style defaults.

6. Verify the working tree, not the UI pin

After install or update, in the plugin’s Git checkout:

  • Compare git rev-parse HEAD to the marketplace pin.
  • Abort / reinstall if they disagree.
  • Do not trust a green “pinned” badge alone—that is the bug class.

Air’s durable fix is effectively that assertion inside the agent. Until every agent does it, you are the control.

7. After upgrading, reinstall or re-verify plugins

Because public reporting does not confirm that an agent upgrade cleans already-swapped trees, reinstall critical plugins from known-good pins and re-check HEAD. Rotate any credentials the agent could have read if you have reason to suspect compromise.

8. Shrink the blast radius on purpose

Even a perfect pin does not make an evil plugin safe.

  • Run agents with scoped tokens (repo-limited PATs, short TTL, no org-owner keys in the env).
  • Keep production cloud credentials out of the agent’s environment by default.
  • Prefer container / VM / dedicated user accounts for untrusted plugins (CSA’s sandboxing guidance is directionally right here).
  • Separate “fun experimental skills” agents from “touches prod” agents.

9. Decide Gemini CLI and Copilot policy explicitly

  • Gemini CLI: migrate toward Antigravity (or another maintained agent) rather than carrying a deprecated tool with a won’t-fix marketplace path.
  • Copilot: until Microsoft ships explicit post-checkout verification, restrict plugin sources (GitHub-only where possible), disable auto-updates, and keep a human in the loop for marketplace adds.

10. Write the policy down in one page

Indie hackers skip this; founders regret skipping it. One page is enough:

  • Approved agents + minimum versions
  • Approved plugin hosts
  • Auto-update on/off rules
  • Who can add a marketplace
  • What to do after a disclosure (this checklist)

Clear takeaways

  1. Plugin4Shell is a supply-chain / integrity bug, not a clever prompt. The agent trusted Git’s checkout without verifying the result.
  2. SHA pinning without post-checkout verification is incomplete. Requesting a hash is not the same as running that hash.
  3. Patches exist for Claude Code (≥ 2.1.179) and Codex (≥ 0.146.0) per Air and corroborating coverage; Copilot lacked a client fix at disclosure; Gemini CLI will not be fixed—migrate.
  4. GitHub’s host-side block helps for the branch-name variant on GitHub-hosted plugins, but it is not a universal agent fix—Bitbucket / self-hosted marketplaces and Gemini’s FETCH_HEAD path remain in the threat model.
  5. Treat plugins like dependencies: inventory, pin agent versions, control auto-update, verify HEAD, sandbox credentials.
  6. No public evidence of mass exploitation as of mid-September 2026 does not mean “ignore this.” It means you still have time to harden before the next copycat.

If you want a second set of eyes

If you are wiring AI coding agents into a product workflow—or auditing an existing setup after this disclosure—and want a practical pass on versions, plugin policy, and credential scope, you can reach out via the contact form on iamtayyab.com. No hard sell: a short conversation about whether your agent setup matches the checklist above is enough.

About the author

Muhammad Tayyab is a full stack and mobile developer. He builds consumer products under dawnapps.co, including DripScore — an AI outfit rating app on the App Store.

Sources

Back to all posts
Thanks for reading 🙏