A commit hash is supposed to answer a simple question: exactly which code will run? Plugin4Shell shows that four popular AI coding agents recorded the right-looking pin but failed to verify that Git had actually placed that commit in the working directory.

AIR Security's research covers Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. A malicious plugin repository owner could create a branch whose name resembled the pinned commit. On Git hosts that permit the ambiguous reference, checkout could resolve to the branch instead. The agent then loaded the resulting plugin without checking that the working tree matched the reviewed commit object.

A marketplace could correctly store a reviewed hash and still lose control at installation time. The vulnerable agent delegated reference resolution to Git and treated a successful checkout as proof that the pin had been honoured. Background plugin updates made the path zero-click in products where automatic updates were enabled.

Git-host behaviour changes exposure. GitHub rejects some branch names that look like full commit hashes, limiting the demonstrated technique there. Bitbucket and self-hosted Git services may allow the conflicting name. That is why a safe conclusion cannot be based only on which marketplace a company uses.

No malicious exploitation has been established. AIR produced a working proof of concept against the four agents during coordinated research. The absence of an observed campaign does not remove the supply-chain consequence, but it must not be presented as an active breach.

The wider lesson is that a pin is…