Build · founder · 9 min read

The Fix for Last Month's Agent Supply Chain Problem Doesn't Work

Plugin4Shell defeats SHA pinning in Claude Code, Codex, Copilot and Gemini CLI. Two are patched, two are not. Here's which version you need.

Published September 17, 2026 ·

security ai-agents supply-chain claude-code coding-agents

This site has run four guides in six weeks about the add-ons you install into your coding agent — skills, plugins, MCP servers — and every one of them ended in roughly the same place: install-time review is not enough, because the thing you reviewed can be swapped after you review it.

The industry has an answer to that, and it is a good one. It’s called SHA pinning. You review a plugin at one specific version, write down the cryptographic fingerprint of that exact version, and from then on your agent installs that fingerprint and nothing else. Even if the author’s account gets stolen tomorrow, you keep running the code you actually read.

On Thursday, security researchers at Air published Plugin4Shell: a bug that makes the pin meaningless. It affects Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI — all four of the major coding agents, with the same design error in each one.

What actually goes wrong

The pin is a 40-character hexadecimal fingerprint. Your agent runs the git equivalent of “go fetch this repository, then switch to this exact fingerprint.”

The problem is that git lets you name a branch after a fingerprint. And when a name is both a valid branch name and a valid fingerprint, git picks the branch. It prints a one-line warning that nobody reads and carries on.

So the attack is: publish a real, working, useful plugin. Let it pass review. Let people install it. Ship a routine update, which causes the marketplace to re-pin to a new fingerprint. Then create a branch named after that new fingerprint, point it at malicious code, and make it the repository’s default branch. Your agent asks for the fingerprint, git hands back the branch, the malicious code runs, and the agent reports a successful install at the pinned commit.

As Air’s researchers put it: the agent “checks out the exact commit the marketplace pinned but never verifies it landed there.”

Gemini CLI has a slightly different version of the same hole — it fetches the right commit, records it, then checks out a reference called FETCH_HEAD without confirming that’s what it got. Name your default branch FETCH_HEAD and the correct commit is silently thrown away.

Why this one is worse than the others

Three things, and the third is the one that matters for you.

It’s zero-click. Claude Code and Codex auto-update installed plugins in the background by default. You don’t install anything. You don’t approve anything. You don’t see a prompt. A plugin you already had gets replaced while you’re doing something else.

Doing the right thing doesn’t help. Every previous story on this shelf had an implied “well, you should have been more careful” underneath it. This one doesn’t. The victim is specifically the person who reviewed the plugin, pinned it to a reviewed commit, and relied on the pin. Every vetting process built on pinning inherits the failure.

No marketplace can fix it for you. The pin is resolved on your machine, inside your agent. A marketplace can’t enforce a guarantee it doesn’t control. The fix has to ship in the agent, which means updating your agent is the only complete mitigation — and only two of the four vendors shipped one.

The patch status, which is the actionable part

Agent	Status	What you do
Claude Code	Patched in 2.1.179	Update. Anything older is exposed.
OpenAI Codex	Patched in 0.146.0	Update. Anything older is exposed.
GitHub Copilot	Not patched	No fix available. See below.
Gemini CLI	Will never be patched	Migrate to Antigravity.

Air disclosed to all four vendors in June. Anthropic confirmed its fix on June 17; OpenAI’s landed by August 12. Google told Air on August 4 that it won’t patch because Gemini CLI is deprecated — which is consistent with what we already knew about that sunset, though it means the enterprise licence holders who kept access are now holding an agent with a permanent unpatched RCE.

Microsoft is the awkward one. GitHub told The Register that Plugin4Shell doesn’t affect GitHub, because GitHub refuses to let anyone create a branch named like a 40-character hash — which is true, and does close the attack on GitHub-hosted marketplaces. Air’s response is that agents support marketplaces hosted elsewhere. Bitbucket allows hash-shaped branch names. So does any self-hosted git server. Anthropic’s own documentation lists both as valid marketplace backends. So the GitHub mitigation protects GitHub and doesn’t protect Copilot, which still supports the other hosts.

Air also says Microsoft never responded to the June disclosure, attributing it to disclosure volume rather than indifference. Microsoft had not responded to The Register at the time of publication either.

What to actually do this week

1. Check your agent version and update it. claude --version should report 2.1.179 or newer. codex --version should report 0.146.0 or newer. This is the whole fix for two of the four agents, and it takes a minute.
2. If you use Copilot with plugins from a non-GitHub marketplace, stop until Microsoft ships a fix. If your plugins come from GitHub-hosted marketplaces only, GitHub’s branch-name restriction covers you for now. If you don’t know where your plugins come from, that’s the thing to find out.
3. If you’re still on Gemini CLI, this is the last argument you needed. Migrate to Antigravity, which isn’t reachable by this attack because it has no marketplace plugin SHA pinning to bypass.
4. Turn off plugin auto-update if your agent lets you. It’s the mechanism that makes this zero-click, and it will be the mechanism that makes the next one zero-click too.
5. Re-run a skills audit. The free scanners we covered on September 14 still work and are still worth twenty minutes.

The honest read

Nobody has found this being used against real people. Air found it in May, disclosed in June, and published on Thursday after two vendors shipped fixes. That’s coordinated disclosure working the way it’s supposed to.

Air also sells a product that mitigates exactly this class of attack, and the report says twice that its customers weren’t affected. That’s not a reason to discount the research — the technical writeup is specific enough that anyone can verify it, and two vendors patching is independent confirmation. But it’s worth knowing who’s telling you.

The part that should stay with you isn’t the bug. It’s that the same design error appeared in four products built by four separate frontier labs, independently, because they all reached for the same obvious implementation and none of them added the one line that checks the result. That’s what a young ecosystem looks like. The add-on layer of AI coding is roughly where npm was in 2016, and the safest assumption is that the mitigation you’re relying on this month is the thing somebody publishes a bypass for next month.

Which is a bleak note to end on, so here’s the practical version instead: update your agent, know where your plugins come from, and treat “it’s pinned” as a good habit rather than a guarantee.