A team that pins an AI coding plugin to one reviewed Git commit is trying to guarantee that nothing changes underneath it. Researchers at Air Security say that in four of the best-known coding agents, nothing confirms the guarantee held.
On Thursday, the company’s research lab published a disclosure it calls Plugin4Shell. It describes a flaw in how Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot and Google’s Gemini CLI install plugins. The agents, AIR says, check out the pinned commit and move on without verifying that the code on disk is the code that was pinned.
This is a disclosure, not an incident. No party has reported a breach, data loss or exploitation in the wild, and no CVE identifier or CVSS score exists. AIR’s “high severity” label is the company’s own characterisation.
The safeguard that was supposed to hold
AI coding agents pull add-ons from marketplaces, called plugins, skills or extensions depending on the product. To protect against an upstream repository being taken over after review, marketplaces lock each plugin to a single Git commit hash. The reviewed code is meant to be the only code that ever installs.
AIR researchers Or Nevo, Dor Granat and Niv Hoffman found that the tested agents never confirm the working tree landed on that commit. Anyone who controls the plugin’s upstream repository can steer the checkout toward different code while the pin still looks honoured.
Two tricks, one missing assertion
Claude Code, Codex and GitHub Copilot run an ordinary clone and then check out the pinned hash. Git allows a branch to be named with 40 hexadecimal characters, the same shape as a commit hash. When a name could be either a ref or an object ID, Git picks the ref and prints only an ambiguity warning. OpenAI’s own description of the defect, in a pull request it merged in July, says Git “can interpret a requested commit SHA as a branch name.”
An attacker who names a branch after the pinned hash and makes it the repository’s default branch gets the clone to create it locally. The checkout then lands on attacker-controlled content. The branch must be the default. A non-default branch arrives only as a remote-tracking ref, and the checkout falls back to the genuine commit.
Gemini CLI takes a different route. It clones shallow, fetches the pinned commit, then checks out FETCH_HEAD. If the repository’s default branch is itself named FETCH_HEAD, the checkout resolves to that branch and the correctly fetched commit is discarded.
AIR’s proposed fix is one line of logic inside each agent. After checkout, compare the output of git rev-parse HEAD against the pinned hash and abort on a mismatch. The check must inspect the resolved HEAD, not the requested ref, which is exactly the gap the Gemini variant exploits. It has to run in the agent because the pin is resolved on the client side.
Why AIR calls it zero-click
The researchers put their conclusion bluntly: “The result is zero-click remote code execution.”
Their reasoning has two parts. Plugins inherit the permissions of the developer running the agent, so code executing inside one already has that person’s reach into source code, credentials, internal systems and production environments. And agents refresh installed plugins in the background, which AIR says is the default in Claude Code and Codex. Bump the pin, and a plugin that was already installed and trusted can be replaced with no prompt and no install step.
Where the headline narrows
The scope of that auto-update default is where the story gets more complicated. The Hacker News checked the shipped marketplaces on 18 September. It reported that every plugin in Anthropic’s community catalog, and in the default Claude Code and Copilot catalogs, points to a GitHub repository. It also reported, citing Anthropic and GitHub documentation, that background auto-update is on by default only for the agents’ own GitHub-hosted marketplaces and is off or optional for third-party ones. Anthropic’s plugin documentation covers how its marketplaces are set up. If both findings hold, a user who installs only from default marketplaces is not exposed to the branch-name variant.
GitHub gave The Register a reason. A spokesperson said the platform “does not allow users to create branch or tag names that resemble commit SHAs,” and added that this means the reported flaw cannot be exploited there.
AIR’s rebuttal is that marketplaces can also live on Bitbucket or self-hosted Git servers, which the agents officially support, and that Copilot supports such marketplaces. AIR also says it received no response from Microsoft after reporting the issue in June. The Register reported that Microsoft did not immediately respond to its request for comment. Both positions can be true at once.
The GitHub rule is also a narrower shield than it first appears. A ban on hash-shaped branch names does not obviously stop the FETCH_HEAD trick, so the reassurance does not clearly extend to Gemini CLI, the agent AIR says will not be fixed.
Who has patched, and who says they won’t
Claude Code is fixed in version 2.1.179, according to AIR, which says Anthropic confirmed the fix on 17 June. Anthropic’s release notes for that version do not mention it, and the company has published no advisory.
Codex has the firmest footing. OpenAI merged its fix on 22 July, and AIR verified version 0.146.0 as fixed on 12 August. GitHub Copilot has no patch, by AIR’s account, and GitHub disputes that the flaw is exploitable on its platform.
Gemini CLI is the murkiest. AIR says Google told it on 4 August that no fix would ship because the tool is deprecated, and advised moving to Antigravity. Google’s public transition notices say enterprise access continues, and that it will keep shipping bug and security fixes for enterprise customers. Google has not publicly addressed this flaw. None of the four vendors has an on-the-record statement on it that could be located.
Who is telling the story
AIR sells controls for enterprise AI agents. Its post says customers using Air Marketplace and Air Filter were unaffected, and it closes with a prompt to book a demo. The technical core is partly corroborated, by OpenAI’s code change and by The Hacker News reproducing the Git behaviour locally. But the disclosure itself is the disclosing party’s account.
The larger claims are AIR’s alone. That includes “millions of agents,” which is an estimate of the installed base rather than a count of vulnerable installations, and the description of this as the first supply-chain vulnerability of the AI agent ecosystem. The same goes for figures from its earlier research: a malicious skill reaching more than 26,000 agents, 925 hijacked skills affecting 134,000 agents, and 155 hijackable MCP servers. None has been independently verified.
A shared assumption, not shared code
The pattern may matter more than the exploit. Four vendors did not share a library or a compromised dependency. They shared an assumption, that naming a commit and verifying it are the same operation. Most published AI-agent security research targets prompt injection or model behaviour. This one targets how code reaches the agent, and it lands on pinning, the control enterprises were told to rely on. It adds to the wider security risks of enterprise AI tooling.
It also exposes how vendors handle these reports. By AIR’s account, two fixed the flaw, one declined and one stayed silent, with no CVE, no advisories and no coordinated publication. That raises vendor patch accountability questions for any company standardising on AI coding agents.
What to watch next
The biggest open thread is whether Microsoft ships a Copilot change or holds to GitHub’s platform-level position. Watch also for a CVE assignment, which would bring scanner and SBOM coverage with it, and for a retroactive advisory from Anthropic. Google’s position on enterprise Gemini CLI builds is unresolved and needs a direct answer.
One technical question is still open. None of the sources say whether updating an affected agent removes a plugin that was already swapped, or only blocks future swaps, so “update and you’re clean” cannot be assumed. If in-the-wild exploitation ever appears, inclusion in CISA’s Known Exploited Vulnerabilities catalog would be the signal.
The fix is short. How quickly the remaining agents adopt something like it will say more about AI tooling security than the flaw does.