Plugin4Shell: the plugin pin that never actually held

Four of the most widely used AI coding agents will happily run code from a plugin that was pinned exactly as their own security model intended, according to research published by Air Security's lab. The flaw, which the company calls Plugin4Shell, gives an attacker remote code execution on a developer's machine with no click, no prompt and no warning, and it affects Claude Code, OpenAI's Codex, GitHub Copilot and Gemini CLI.

SHA pinning is the control everyone leans on here. A plugin is reviewed at one specific commit, that commit is written into the pin, and everything afterwards is supposed to run that reviewed code and nothing else. Plugin4Shell breaks the guarantee without breaking the pin: the affected agents check out the pinned commit and never check that they actually landed on it. Git resolves a name that is both a valid ref and an object id in favour of the ref, so an attacker who controls the plugin repository can create a branch named with the exact 40-hex string of the pinned commit, make it the repository default, and point it at malicious code. The pinned commit itself can sit there untouched. The checkout resolves to the branch, the agent reports a successful install, and the attacker owns the working tree.

Why the attack needs nothing from the victim

The chain starts with a genuinely benign plugin that passes review and gets installed, which is the part Air has already demonstrated at scale in two earlier projects. The attacker then ships a routine update, the marketplace re-pins to the new commit, and the attacker creates a branch carrying that commit's hash and makes it the default. From there the swap reaches machines that are already running the plugin, because Claude Code and Codex update installed plugins in the background by default. Nobody has to be persuaded to install anything new. The plugin only has to already be there.

Gemini CLI has a second variant, and no fix is coming

Gemini CLI does not check out a commit at all. It fetches the pinned revision and runs a checkout against the fetch head, and that reference resolves to a default branch named the same way if one exists, discarding the fetched commit silently. Air's suggested fix is one assertion: after checkout, resolve the commit in the working tree and abort unless it matches the pin. Only the agent can enforce that, because the pin is resolved on the client. Anthropic shipped a fix in Claude Code 2.1.179, which appears in its public changelog, and Air lists Codex 0.146.0 as verified fixed on 12 August. Google confirmed on 4 August that it will not patch Gemini CLI because the tool is being deprecated, and directs those users to Antigravity. Microsoft has not shipped a fix for GitHub Copilot.

The marketplaces cannot close this themselves

GitHub rejects a branch name made of 40 hex characters outright, so the branch variant cannot be set up on repositories hosted there, and GitHub has said as much publicly. Bitbucket and self-hosted git servers do allow it, and Anthropic's own documentation lists both as supported marketplace backends, so the mitigation is really a restriction on where a marketplace may live rather than a fix. It also does nothing for the Gemini CLI variant. The uncomfortable conclusion is that vetting and pinning, the practice enterprises adopt precisely because they do not trust community marketplaces, inherits the failure rather than preventing it.

Our opinion

The cleverness of Plugin4Shell is almost an afterthought. Git preferring a ref over an identically named object id is long-documented behaviour, and the exploit is an attacker being rude enough to use it. What the report actually establishes is that a control nobody verified was doing any work: pinning made reviewers feel finished while the agent never once asked git where it had ended up. Microsoft leaving Copilot unpatched is the part that should worry enterprises most, because it means a flaw that defeats the recommended workflow stays open in the one agent most likely to be deployed through a corporate GitHub tenant. Google's answer, meanwhile, is to move users to a platform with no plugin marketplace to bypass, which is less a remediation than a concession that the marketplace was the problem all along. Air sells a competing product, so read its framing with that in mind, but the assertion it recommends is one line of code and every affected vendor should have shipped it in June.