Plugin4Shell let pinned AI-agent plugins resolve to different attacker-controlled code

Reconstruction

Plugin marketplaces try to solve a familiar supply-chain problem by pinning an approved plugin to an immutable Git commit. That guarantee sounds cryptographic: review commit X, record its SHA, and later installs should execute commit X even if the repository changes.

Plugin4Shell breaks the promise one layer lower. AIR found that four coding agents asked Git to check out the pinned identity but did not verify the commit actually materialized in the working tree. For Claude Code, Codex and GitHub Copilot, an attacker controlling the upstream repository could use a default branch whose name exactly matched the 40-character SHA on hosts that allow that naming pattern. Git resolves the ambiguous name as a ref, the command succeeds, and the agent can install attacker-controlled branch content while the marketplace still appears pinned to the reviewed commit.

Gemini CLI reached the same integrity failure through a different path. It fetched the desired object and then checked out FETCH_HEAD; a default branch with that name could redirect resolution. The shared bug is therefore not that Git is broken. The client treated command success as proof of artifact identity.

The attack becomes zero-click where installed plugins update in the background. A benign plugin can pass review, become trusted, and later materialize different code after the upstream repository is changed or hijacked. That code executes with the permissions of the developer running the coding agent. Unlike the earlier Codex malicious-repository CVEs, the user does not have to open an obviously attacker-controlled project: the compromised object is an extension the ecosystem already reviewed and pinned.

Mechanism & boundary

1. 01

   Publish or inherit control of a legitimate plugin repository

   The attacker either owns a plugin that passes marketplace review or later gains control of the repository behind an already trusted plugin.

   Boundary: publisher identity / trusted marketplace entry

2. 02

   Marketplace pins a reviewed Git commit

   The catalog records an immutable-looking SHA intended to bind future installs and updates to reviewed code.

   Boundary: reviewed artifact / mutable upstream repository

3. 03

   Exploit ambiguous Git name resolution

   On affected paths, attacker-controlled ref names can win resolution even though the client requested the pinned identity.

   Boundary: requested commit identity / materialized working tree

4. 04

   Client fails to verify resolved HEAD

   The Git command returns success and the agent accepts the checkout without proving that HEAD equals the reviewed commit.

   Boundary: command success / artifact-integrity proof

5. 05

   Background update installs the substituted plugin

   Where plugin updates run automatically, the attacker-controlled working tree can reach an already-installed agent without a new user click.

   Boundary: trusted extension update / local code execution

6. 06

   Plugin code inherits developer authority

   The malicious extension can execute with whatever filesystem, credential, repository and tool access the coding-agent process possesses.

   Boundary: plugin ecosystem / developer workstation authority

Timeline

1. 2026-06

   AIR reports Plugin4Shell to affected vendors

   discovery

   AIR says the four agent vendors were notified before public disclosure.

2. Jun 16, 2026

   Claude Code 2.1.179 contains the reported fix

   mitigation

   AIR identifies 2.1.179 as the fixed Claude Code release.

3. Jul 22, 2026

   OpenAI merges Codex checkout-verification fix

   mitigation

   PR #34644 documents the SHA/ref ambiguity and adds a resolved-HEAD equality check.

4. Jul 29, 2026

   Codex 0.146.0 carries the fix

   mitigation

   AIR identifies Codex 0.146.0 as the fixed release.

5. Sep 17, 2026

   AIR publicly discloses Plugin4Shell

   report

   The disclosure publishes the four-agent PoC, host-specific limitations and vendor status.

Claims & evidence

Implications

Plugin4Shell shows that a security property can be correct in the marketplace database and false on the developer's machine. The reviewed SHA was not enough because the client never verified the materialized object. Agent extension ecosystems therefore need end-to-end artifact identity: publisher, repository, version, checkout result and runtime permissions all belong to the same trust decision. For security auditors using coding agents, this is especially important because a compromised extension sits below the model and can tamper with the very environment being used to review code.

Controls & mitigations

• Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later.
• After every plugin checkout, resolve the actual HEAD commit and compare it byte-for-byte with the approved pinned SHA; abort on mismatch.
• Prefer artifact stores or Git hosts that prevent ambiguous ref names, while treating host-side restrictions as defense in depth rather than a replacement for client verification.
• Disable or tightly control automatic plugin updates when the client cannot prove artifact identity.
• Treat plugin repository ownership changes, deleted or reclaimed namespaces and marketplace repinning as supply-chain security events.
• Run agent extensions with least privilege because a plugin compromise inherits the coding agent's filesystem, credential and repository access.

What remains unknown

• No cited source establishes exploitation in the wild.
• The practical exploitability of the SHA-shaped branch variant depends on the Git host's branch-name policy and marketplace configuration.
• The cited public material does not establish how many installed agents were actually exposed to attacker-controlled repositories.
• GitHub's host-side mitigation covers GitHub-hosted repositories for the SHA-shaped branch variant, but it is not the same control as client-side resolved-commit verification.

Connected research