The report
A reviewed plugin pinned to a Git SHA is supposed to be boring. That is the point: even if the upstream repository changes later, the coding agent should keep installing the exact code that was reviewed.
Plugin4Shell broke that guarantee in four major coding agents.
AIR Security demonstrated proof-of-concept attacks against Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. The clients requested pinned plugin revisions, but they treated a successful Git checkout as proof that the right commit had been installed. They did not verify the final resolved `HEAD`.
For Claude Code, Codex and Copilot, the main variant uses a default branch whose name is the same 40-character hexadecimal string as the approved commit. On Git hosts that permit such branch names, Git can resolve the ambiguous name as a branch instead of the immutable object. The command succeeds and attacker-controlled code appears in the working tree while the marketplace still looks correctly pinned.
That limitation matters: GitHub itself rejects SHA-shaped branch names, so the default GitHub-hosted path is not exposed to that particular variant. AIR notes that other supported hosts, including Bitbucket and self-hosted Git, can permit it.
Gemini CLI had a different ambiguity. Its affected flow fetched the requested commit and then checked out `FETCH_HEAD`; a default branch named `FETCH_HEAD` could redirect the final checkout.
The missing control is small and important: resolve the commit that actually landed in the working tree and compare it with the approved SHA. OpenAI's public Codex fix does exactly that. AIR reports Claude Code fixed in 2.1.179 and Codex in 0.146.0.
Background plugin updates create the zero-click path. A plugin can be reviewed while benign, become trusted, and later be replaced upstream; the vulnerable client can then auto-update into different code without another user approval.
This is different from the earlier Codex malicious-repository vulnerabilities. Plugin4Shell attacks a component that the user and marketplace already decided to trust. It sits below the model layer and inherits the permissions of the coding-agent process itself.
No cited evidence shows exploitation in the wild. The finding is nevertheless a clean example of an agent supply-chain boundary failing at artifact identity rather than at model reasoning.