The AI Pulse

Plugin4Shell Broke SHA Pinning Across Four Coding Agents. Two Labs Shipped a Patch. Two Walked Away From the Product.

On Thursday, September 17, 2026, three researchers at AIR Security (Or Nevo, Dor Granat, Niv Hoffman) disclosed Plugin4Shell, a zero-click remote code execution flaw in the plugin systems of the four most-installed AI coding agents on the market: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot from Microsoft, and Google's Gemini CLI. The bug is a broken assumption: every one of these agents told developers that pinning a plugin to a specific commit SHA locked the plugin to the reviewed code at that SHA, and the check verified the pin was declared rather than that the code fetched at install or update time actually landed there. A repository owner swapping a branch identically named to a pinned commit, or rewriting history under a moved tag on hosts that permit it, produces a plugin whose content hash on disk is not the pin the developer signed off on, and the malicious code runs the moment the plugin loads inside the coding agent's own process, credentials, and file-system scope. Ninety-six hours after disclosure the split on the response is the story. Anthropic shipped Claude Code 2.1.179 with a fix. OpenAI shipped Codex 0.146.0. Microsoft has released no patch and the affected plugin marketplaces (Bitbucket, GitLab, self-hosted Git) remain exposed on the client. Google retired Gemini CLI and routed users to Antigravity CLI, leaving every existing Gemini CLI install permanently vulnerable with no version number that fixes it. Two of the four coding-agent vendors treated Plugin4Shell as a shipping bug on a shipping product, the other two treated it as a decision about whether the product ships. AIR notified vendors in June 2026 for roughly a three-month coordinated-disclosure window, no CVE has been assigned as of publication, no exploitation in the wild has been claimed. The install-base ratio nobody quoted: GitHub Copilot enterprise seats are reported over 20 million on the last public disclosure, which is more than the combined disclosed userbases of Claude Code and Codex, so weighted by userbase rather than by product count more coding agents on more developer machines this morning are exposed than are patched. The verified-feed read: SHA pinning was a promise the plugin manager made and the verifier and the fetcher lived inside the same process controlled by the same vendor, no independent artifact a developer could audit to confirm the pin held, the same failure shape TensorFeed covered on Stainless SDK and Starlette BadHost. Practical read: audit whether your fleet is on Claude Code 2.1.179 or Codex 0.146.0 or higher, treat Gemini CLI installs as permanently exposed and remove them, audit the Copilot plugin repository allowlist for anything pinning to a tag rather than an immutable SHA. Our Take: the number that matters is two, two of the four largest coding agents on the market treated a supply-chain compromise as a patchable defect on a product they defend and two did not, the split does not indict the two silent vendors but exposes that the coding agent (the highest-privilege piece of software on a developer laptop this year) sits inside four separate governance models, and the response to a shared bug is a legibility test for each. The two vendors who read the bug as urgent are the two who priced the agent as a stand-alone product line, the two vendors who did not are the two treating the agent as either a platform layer or an experiment. Plugin4Shell is the reality check on the last two weeks of voluntary-governance essays authored at the model layer: none of them binds the plugin ecosystem, the harness layer, or the coding agent's privilege on a laptop. Three signposts for the next 60 days: whether Microsoft publishes a patched Copilot client that fences Bitbucket, GitLab, and self-hosted plugin hosts before the end of Q3, whether any coding agent ships an independent signed content-verification receipt for plugin installs, whether MITRE assigns a CVE and NVD scores the bug at a severity that forces enterprise procurement teams to update their coding-agent allowlists. Kira Nolan, September 21, 2026.