Plugin4Shell: pinning to a SHA is worthless if nobody checks the SHA

One-sentence summary: coding agents pin their plugins to a specific commit so nobody can slip new code past you, and then they don't check that the code they downloaded actually is that commit. And since they auto-update, the attack doesn't need you to click on anything.

What happened

A team at security startup Air — Or Nevo, Dor Granat and Niv Hoffman — published a report on Thursday naming the flaw "Plugin4Shell". The Register has the story. It affects the usual five suspects: Claude Code, OpenAI's Codex, Gemini CLI, Microsoft's Copilot and GitHub Copilot. The outcome is remote code execution with no user interaction, reaching as far as the agent reaches: your repositories, your tokens, your machine.

The mechanism under attack isn't the model. It's the SHA pinning used by plugin and skill marketplaces: instead of pointing at a branch or a version tag — which move — you pin the plugin to an immutable commit hash. If the plugin's repository is compromised tomorrow, you carry on running the code you audited. That's the idea.

The snag Air found: the agent asks for that exact commit, but never verifies the working tree actually ended up there. An attacker controlling the plugin's repository makes the checkout resolve to their code while the pin still looks honoured. They call it a "plugin SHA-pinning bypass". GitHub's own mitigation hints at how it's done: they don't allow branch or tag names that look like commit hashes.

The patch situation as it stands:

• Anthropic fixed it in Claude Code 2.1.179.
• OpenAI fixed it in Codex 0.146.0.
• Google has deprecated Gemini CLI and says it won't patch: it points users to Antigravity, which it says isn't vulnerable. Every existing install stays as it is.
• Microsoft hasn't fixed it. Air says it notified them back in June, same as the others, and got no reply.

GitHub maintains it isn't affected, thanks to the branch-name rule. Air's answer is that this covers one platform, not the problem: marketplaces can be hosted on Bitbucket or anywhere else, and Copilot supports those marketplaces.

Why it matters

Because a coding agent's plugin is a dependency almost nobody has inventoried. It isn't in your package-lock.json, it isn't in your SBOM, it never went through third-party review. Someone on the team installed it on a Tuesday because it saved them writing four prompts, and it runs with that person's permissions on their laptop: SSH keys, npm token, cloud credentials, the whole repository checked out locally. That's what sits on the other side of this flaw.

And there's a more uncomfortable lesson, one that goes well beyond AI: pinning without verification is a fake seal of approval. Pinning by hash only works if someone compares the hash requested with the hash obtained. Otherwise you've traded real security for the feeling of it, which is worse than having none, because you stop looking.

What I'd do this week, in order:

1. Update the agents. Claude Code to 2.1.179 or later, Codex to 0.146.0 or later. Where a patch exists, it's the only complete mitigation. If anyone on the team is still on Gemini CLI, no fix is coming: migrate, or strip out the third-party plugins.
2. Inventory installed plugins and skills. Not the project's — the machines'. If you can't answer "which extensions does each person's agent have installed", that's today's job.
3. Turn off plugin auto-update wherever you can. That's what turns an incident into a zero-click: content is swapped upstream and it reaches you on its own.
4. Verify the checkout in your own automation. If you have scripts that clone by hash, run git rev-parse HEAD afterwards and compare it with the hash you asked for. Fail if it doesn't match. Two lines, and they cover this entire class of trick.
5. Mirror what you actually use. An internal fork of the plugin, and when you want to bump it, you read the diff. Boring, yes. It works.
6. Shrink the agent's blast radius. The damage from an RCE is exactly what the process can touch. If your coding agent runs with the token that deploys to production, the plugin isn't your problem.

What doesn't change

Let's be fair about the caveats, because there are several.

The report is signed by a company that sells protection for enterprise AI agents. That doesn't invalidate the finding — the chain is demonstrated end to end, building on their earlier SkillJacking and RepoJacking work — but it's worth reading with the author in mind. There's no evidence in the material of exploitation in the wild: this is a proof of concept, not an ongoing incident.

GitHub's mitigation isn't smoke either. If all your marketplaces and plugins live on GitHub, that particular route is closed. What the researchers say is that it doesn't cover other platforms, and they're right; what you can't conclude is that GitHub did nothing.

And the figure of nearly 90 per cent of the Fortune 500 using Copilot is Microsoft's product-adoption number, not a count of exposed machines. It tells you the size of the board, not the size of the fire.

What doesn't change, above all, is the nature of the problem: this is a plain old supply-chain attack, with the twist that the chain now enters through a tool we installed six months ago without thinking too hard about it. The hygiene you apply to your code dependencies applies here just the same. You just weren't applying it yet.

If you'd like a look at what your team has installed, tell me and we'll go through it.

Best, Vicente.