Plugin marketplaces for AI coding agents sell one specific promise: a plugin is reviewed once, pinned to an exact Git commit hash, and whatever runs later is exactly that reviewed code. Security firm Air's "Plugin4Shell" finding, disclosed September 17-18, 2026, showed that promise broke in four major agents at once — not through a flaw in review, but through a gap between pinning a hash and verifying it held.
What the source says
Per the Cloud Security Alliance research note: Claude Code, Codex and GitHub Copilot resolve a pinned plugin with git checkout <SHA>. Git's reference resolution is ambiguous by design — if an attacker who controls the plugin repository creates a branch named identically to the pinned commit hash and makes it the default branch, the checkout can resolve to that branch instead of the real commit. The agent ends up running different, attacker-controlled code while still reporting the pin as satisfied. Gemini CLI uses a different two-step sequence, git fetch origin <SHA> then git checkout FETCH_HEAD, defeated the same way by naming the default branch FETCH_HEAD.
In every case the missing step is identical: none of the four agents check, after checkout, that the resulting working tree actually matches the hash it pinned. Claude Code and Codex both enable plugin auto-update by default, so the substitution can take effect with no prompt and no user action.
Air reported the flaw to Anthropic, OpenAI, Microsoft and Google in June 2026, two months ahead of publication. Anthropic shipped a fix in Claude Code 2.1.179; OpenAI fixed Codex in 0.146.0. Microsoft had not patched Copilot as of disclosure, and Google told Air it would not patch Gemini CLI at all, pointing users toward Antigravity instead — the product is being deprecated.
What it doesn't establish
No CVE had been assigned at disclosure, and no in-the-wild exploitation was reported. This is a responsible-disclosure finding against a trusted safety mechanism, not a documented breach — nobody is known to have actually lost code or credentials to it. We've filed it verified: false in our own scoring because it rests on one security firm's research note rather than independent reproduction on our end, though the methodology (coordinated vendor disclosure, named fix versions) is far stronger than a typical unverified report.
Why it matters anyway
Two of four agents remain unpatched as of this writing. If your workflow installs plugins by commit hash and trusts that pin, the trust was misplaced for Copilot and for Gemini CLI specifically — and for the two that did patch, any plugin installed or auto-updated before the fix version should be assumed potentially substituted, not just outdated.
Scored 6/10 (medium) on severity: a widely-used category across four major agents (scope), but nothing confirmed lost since this is a disclosed, patchable flaw rather than a breach, and the blast radius is the user's own developer-machine privileges. Full scoring and source: https://www.stupidllm.com/incident/STUPID-2026-0164/
Top comments (0)