How Plugin4Shell Made Reviewed AI Coding Plugins Run Different Code
A commit hash is supposed to answer a simple question: exactly which code will run? Plugin4Shell shows that four popular AI coding agents recorded the right-looking pin but failed to verify that Git had actually placed that commit in the working directory.
AIR Security’s research covers Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. A malicious plugin repository owner could create a branch whose name resembled the pinned commit. On Git hosts that permit the ambiguous reference, checkout could resolve to the branch instead. The agent then loaded the resulting plugin without checking that the working tree matched the reviewed commit object.
The trust failure happened after the marketplace check
A marketplace could correctly store a reviewed hash and still lose control at installation time. The vulnerable agent delegated reference resolution to Git and treated a successful checkout as proof that the pin had been honoured. Background plugin updates made the path zero-click in products where automatic updates were enabled.
Git-host behaviour changes exposure. GitHub rejects some branch names that look like full commit hashes, limiting the demonstrated technique there. Bitbucket and self-hosted Git services may allow the conflicting name. That is why a safe conclusion cannot be based only on which marketplace a company uses.
Patch status is not uniform
| Agent | Status reported by AIR | Action |
|---|---|---|
| Claude Code | Fixed in 2.1.179 | Upgrade and verify the running version |
| OpenAI Codex | Fixed in 0.146.0 | Upgrade and verify the running version |
| GitHub Copilot | No fix shipped at public disclosure | Restrict plugin sources and avoid hosting that permits ambiguous references |
| Gemini CLI | Deprecated and not scheduled for a fix | Migrate to Google’s replacement tooling |
No malicious exploitation has been established. AIR produced a working proof of concept against the four agents during coordinated research. The absence of an observed campaign does not remove the supply-chain consequence, but it must not be presented as an active breach.
Verify the artefact, not the reference string
- Update patched agents. Enforce minimum versions rather than relying on users to notice background updates.
- Disable unneeded marketplaces. Limit plugin installation to approved sources and repositories.
- Check the resolved commit. Validate the actual HEAD and tree hash after checkout.
- Review automatic updates. A previously reviewed plugin can become the delivery path when repository control changes.
- Reduce agent privilege. Plugins execute where the coding agent can reach files, credentials, terminals and repositories.
- Monitor plugin changes. Record source, resolved commit, signer and installation time so an incident can be reconstructed.
The wider lesson is that a pin is a claim, not evidence. The security boundary is complete only when the installer verifies the exact artefact it is about to execute.
Sources
- AIR Security, Plugin4Shell, publicly disclosed 17 September 2026 according to the vendor timeline. The accessible page did not provide a reliable publication time.
- The Hacker News, independent reporting, published 18 September 2026.