al-ice.ai

A Branch Named Like a Commit Broke Plugin Pinning in Four Coding Agents

Agent & Supply Chain Security by al-ice.ai Editorial

The industry answer to plugin rug-pulls is SHA pinning: review the code at one commit, pin that commit, and trust that the pinned commit is what runs forever after. On September 17, AIR Security disclosed Plugin4Shell, a flaw showing that four major AI coding agents check out the pinned commit but never verify they landed on it — so whoever controls the plugin's repository can serve different code under an intact-looking pin, with no user interaction at all.

The affected agents are Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. AIR researchers Or Nevo, Dor Granat, and Niv Hoffman built a working attack against all four in May and notified the vendors in June. Anthropic patched Claude Code in 2.1.179 and OpenAI patched Codex in 0.146.0, both before public disclosure. GitHub Copilot has no fix, and Google will not patch the Gemini CLI, which it is retiring. As of September 18 there was no CVE identifier, no vendor-published security advisory, and no sign of real-world exploitation.

The checkout resolves the pin; nothing checks the landing

Marketplaces pin each plugin to a reviewed commit hash, and the agent fetches that snapshot at install time. The defect is that the agent never confirms the code it received matches the hash it asked for. Git itself supplies the confusion: as OpenAI's own fix description puts it, git "can interpret a requested commit SHA as a branch name," so a plugin source can "materialize a different commit than the one it pinned."

Concretely, the owner of a plugin's repository creates a branch whose name is shaped like the pinned 40-character hash and points it at malicious code. The agent resolves the name to the attacker's branch and installs it while still reporting the locked version. There are two ways to get into position, and neither requires controlling the marketplace: contribute a genuinely benign plugin, pass review, and swap its content later — AIR has already demonstrated that getting a plugin into a top marketplace is practical — or hijack a legitimate plugin's repository out from under its maintainer. The latter has precedent from the same team: their SkillJacking work showed 925 already-deployed skills taken over via their backing repositories, affecting a reported 134,000 agents.

Auto-update is what makes it zero-click

A pin bypass at install time still needs the victim to install something. Background auto-update removes that requirement: in Claude Code and Codex, installed plugins refresh on their own by default, so a trusted plugin already on the machine is silently replaced with the malicious version — no install step, no prompt, nothing to notice. The attacker only needs the benign plugin to already be there.

That default has a scope limit worth stating precisely. Auto-update runs by default only for the agents' built-in marketplaces, which are hosted on GitHub, and is off or optional for third-party marketplaces. That distinction interacts directly with the next one: where the attack actually works.

GitHub hosting blunts the branch variant — but not everywhere

GitHub does not allow branch or tag names that look like commit hashes, so a plugin installed from a GitHub repository is not exposed to the branch-name trick. The trick works on hosts that permit such names — Bitbucket or a company's own git server, which these agents also support. The Hacker News checked the agents' default catalogs on September 18 and found every plugin pointing at GitHub repositories, so readers who install only from default marketplaces are not exposed to the branch-name variant, on AIR's and GitHub's own account of the mechanism.

The Gemini CLI is attacked a different way. Instead of a hash-shaped branch, AIR says its installer can be tricked by a repository whose default branch is named FETCH_HEAD — a name GitHub's SHA rule does not clearly block. So GitHub hosting is not an established defense for Gemini CLI plugins, and the Gemini CLI is the agent that will not be fixed. Google stopped serving the consumer Gemini CLI in June and points users at Antigravity, which AIR says this attack cannot reach; enterprise Gemini CLI access continues with updates, but whether a fix for this flaw is among them is unclear.

Only an agent-side fix restores the guarantee

Because each agent resolves the pin on the user's own machine rather than at the marketplace, no marketplace can fix this for users — the patch has to ship in the agent itself. A marketplace can blunt the branch-name variant by allowing only hosts that reject SHA-shaped names, effectively GitHub-only, but that bans hosts the agents officially support and does nothing for the Gemini FETCH_HEAD variant. The pin, in other words, was a verification promise implemented as a checkout request. Until the agent verifies what it received, every downstream vetting process built on pinning — internal review boards, approved-plugin lists, locked manifests — inherits the failure silently.

Two open questions remain. The sources do not say whether updating a patched agent removes a plugin that was already swapped, or only stops future swaps. And Anthropic's release notes for 2.1.179 do not mention the fix — the account that Claude Code is patched is AIR's. Treat the version numbers as the remediation floor, but verify behavior rather than assuming cleanup.

What defenders should do now

  • Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Both fixes shipped before disclosure; there is no reason to run anything older.
  • Audit plugins already installed before the update. Reinstall pinned plugins from their upstream repositories and diff running plugin code against the reviewed commit — updating may stop future swaps without removing an existing one.
  • For Copilot, restrict plugin sources and updates. With no patch available, install only from GitHub-hosted marketplaces, disable automatic updates for third-party plugins where possible, and prefer hosts that reject SHA-shaped ref names.
  • Move Gemini CLI users to Antigravity. Google is retiring the consumer CLI rather than patching it; enterprise Gemini CLI deployments should confirm fix status with Google directly.
  • Inventory non-GitHub plugin origins. Any plugin fetched from Bitbucket or self-hosted git sits on a host where the branch-name trick works — those are the first to re-verify.
  • Stop treating pins as verification in your own tooling. Any internal pipeline that pins a commit without checking out and hashing what it received has the same shape of bug. Verify the landing, not the request.

This is the third act of a story about the agent distribution layer rather than the model. The same team's earlier work put a malicious skill into a trusted marketplace and watched it reach a reported 26,000 agents, then showed existing skills hijacked underneath their maintainers. Plugin4Shell completes the arc: even doing everything right — marketplace review, commit pinning, trusted sources — installs different code than the code that was reviewed. The sandbox escapes disclosed against these same coding agents in July showed the execution boundary ends where host trust begins; Plugin4Shell shows the supply boundary never held in the first place.

Sources: