Coding agents no longer only suggest code: they read files, execute commands and install extensions. Their plugin ecosystem is therefore becoming a real software supply chain.
Why SHA pinning is supposed to protect you
A marketplace can reference a plugin by an exact commit SHA instead of a moving branch. The goal is to ensure that code reviewed today remains identical when it is installed or updated later.
Plugin4Shell shows that this guarantee only holds if the agent verifies the final checkout. AIR Security found that affected agents could request the correct identifier without confirming that HEAD actually matched the expected commit afterwards.
Where is the flaw?
For Claude Code, Codex and GitHub Copilot, AIR describes an ambiguity when the Git hosting service allows a branch whose name exactly resembles a SHA. Git may then resolve that name as a reference rather than the expected object.
This distinction matters: GitHub rejects full SHA-looking branch names. That variant therefore mainly concerns hosting services that allow them, including some self-hosted Git servers and Bitbucket. AIR describes a separate FETCH_HEAD variant for Gemini CLI.
The important control: verify the result
After installation, the agent should resolve the commit actually present in the working tree and abort if it does not match the pinned SHA. Verifying the requested state is not the same as verifying the resulting state.
Why it can become zero-click
The risk increases when already-installed plugins update automatically. If a plugin repository becomes attacker-controlled and a new version is approved by the marketplace, an agent may retrieve and execute substituted content without another user action.
The plugin can then inherit the capabilities of the agent and its session: access to files, repositories, commands and potentially credentials exposed to that environment.
Which agents are affected?
According to AIR Security's published status:
- Claude Code: fixed in version 2.1.179 and later.
- OpenAI Codex: fixed in version 0.146.0 and later.
- GitHub Copilot: AIR reported on September 17 that an equivalent fix was not yet available.
- Gemini CLI: AIR says the affected product is deprecated and will not receive this fix.
As of September 18, The Hacker News reported no publicly documented real-world exploitation and no assigned CVE.
Useful protections now
- Update coding agents to fixed versions where available.
- Limit installed plugins and remove unused ones.
- Reduce privileges for sessions running agents or plugins.
- Avoid unnecessarily exposing secrets to development environments.
- Control automatic updates in sensitive environments.
- Verify the commit actually checked out when the tool or workflow allows it.
AI-agent plugins are dependencies now
The lesson goes beyond this vulnerability. Skills, plugins, MCP servers, Git repositories and external tools should be treated like other software-supply-chain dependencies: provenance, integrity, least privilege, controlled updates and auditability all matter.
As agents become more autonomous, the question is no longer only “do I trust this agent?” but also “what does this agent itself trust?”.
Sources
Published September 20, 2026. Version and remediation status reflect public information available on this date.