Plugin4Shell Broke SHA Pinning Across Four Coding Agents. Two Labs Shipped a Patch. Two Walked Away From the Product.

On Thursday, September 17, 2026, three researchers at AIR Security (Or Nevo, Dor Granat, and Niv Hoffman) published Plugin4Shell, a zero-click remote code execution flaw in the plugin systems of the four most-installed AI coding agents on the market: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot from Microsoft, and Google's Gemini CLI. The bug is not exotic. It is a broken assumption. Every one of these agents told developers that pinning a plugin to a specific commit SHA locked the plugin to the reviewed code at that SHA. It did not. The check verified the pin was declared. It did not verify that the code fetched at install or update time actually landed there.

Ninety-six hours after disclosure, the split on the response is the story. Anthropic shipped Claude Code 2.1.179 with a fix. OpenAI shipped Codex 0.146.0. Microsoft has released no patch. Google retired Gemini CLI and redirected users to Antigravity CLI. Two of the four coding-agent vendors treated Plugin4Shell as a shipping bug on a shipping product. The other two treated it as a decision about whether the product ships.

What Plugin4Shell Actually Is

Every serious plugin manager built in the last twenty years pins to a content hash. The pattern is boring on purpose. You review a plugin at commit a1b2c3, you list that commit in your lockfile, you run the install, the fetch either produces a tree whose SHA matches a1b2c3 or the install fails. Nothing in the middle is trusted. That is the promise. Plugin4Shell is what happens when the plugin manager checks the pin as a string but does not verify the checkout ended at that revision.

The concrete failure mode in the AIR writeup is a repository owner swapping a branch named identically to a pinned commit, or rewriting history under a moved tag on hosts that permit it, and the coding-agent installer following the redirect without noticing the content hash on disk is not the pin the developer signed off on. The malicious code then runs the moment the plugin loads, in the process, under the credentials, and inside the file-system scope the coding agent already owns. On a developer laptop that is full user permissions on the local checkout, on a CI runner it is the deploy key, on a shared workstation with a domain-joined account it is whatever that account can reach.

There is no click. There is no reinstall prompt. There is no approval dialog. The pin the developer trusted was doing zero of the work the pin claimed to do.

The Ninety-Six-Hour Ledger

Four vendors, four responses, one shared bug. Read the column of responses without the product names and it is a legibility test for how each vendor treats the coding agent as a product line. Anthropic and OpenAI treat it as a shipping product they own the calendar on. Microsoft treats it as a feature layer on a platform shipped by GitHub, and the plugin marketplaces implicated (Bitbucket, GitLab, self-hosted Git) are not surfaces Microsoft directly controls. Google treats it as a product it can end.

Why the Split Is the Governance Signal

Coding agents are the highest-privilege software a developer has installed on a machine in 2026. They read the whole tree, they run shell commands, they call out to package registries, and they run continuously in the background while a developer works. When an RCE lands inside that process, the blast radius is not the agent. It is every credential, every SSH key, every session token, and every private repository the agent has already been authorized to reach. A supply-chain compromise inside the plugin manager is not a bug in a coding assistant. It is a foothold inside the developer identity.

The two patched vendors, Anthropic and OpenAI, are the two whose business model treats the coding agent as its own SKU. Claude Code has a seat price, an API line, and a public roadmap that we covered in our piece on last week's 17 percent weekly-limit cut. Codex has been the flagship harness OpenAI is packaging behind the Agents API shipped September 10. Both vendors have a revenue line that decays if the coding agent is unsafe to run on a laptop with any credentials on it. Ninety-six hours to a shipped fix is the calendar of a vendor that reads the bug as an existential threat to a product line.

The two silent vendors are not silent for the same reason. Google retired Gemini CLI. That is a decision. It says the coding agent was not a business Google was going to defend in place, and the fastest path to remediation was to end-of-life the product and route the audience elsewhere. Antigravity CLI is a Google Labs project, not a shipping product with the same install base. The net move is that anyone who currently has Gemini CLI installed holds a permanently vulnerable binary and no path to a patched version.

Microsoft is the harder read. The vulnerable surface, Copilot consuming plugins from Bitbucket, GitLab, and self-hosted Git marketplaces, is a set of third-party hosts Microsoft does not control. A fix has to cover the plugin host inventory question (what remote is this pin actually pointing at, and does that remote treat a tag the way we assume) rather than only the client library. That is real engineering, but it is engineering Anthropic and OpenAI also faced, and finished in four days. Every hour Microsoft does not ship widens the ratio.

The Install Base Ratio Nobody Quoted

There is no public number on total installs of each of the four agents. There is a public number on GitHub Copilot enterprise seats reported at over 20 million in the last public disclosure, which is more than the combined disclosed userbases of Claude Code and Codex. If the ratio of exposed-to-patched installs is weighted by userbase rather than by product count, more coding agents on more developer machines this morning are still exposed than are patched, and the two-of-four framing understates the scope of the vulnerable population by a lot.

The blunt fact is that the median developer running a coding agent this morning does not know that agent was vulnerable, does not know whether the vendor has patched it, and does not have a workflow that would tell them either. That gap is the trust-layer question we made in our piece on the 97 million MCP installs shipped without a common security signal, and Plugin4Shell is the first supply-chain case big enough to make that gap concrete.

The Verifiable-Feed Read

The lesson TensorFeed keeps writing is that trust primitives at the agent layer only work if the assertion can be verified independently of the party making it. SHA pinning was a promise the plugin manager made. Plugin4Shell is what happens when the verifier and the fetcher live inside the same process, both controlled by the same vendor, both signed off by the same person who wrote the loader. There is no independent artifact a developer can audit to confirm the pin held. The failure mode was invisible until AIR Security ran the check the plugin manager never did.

This is the same failure shape we covered in our piece on the Stainless SDK supply-chain incident earlier this year, and the one we mapped against the Starlette BadHost CVE audit. Each time, a primitive that was assumed to enforce a security property (pin, hostname check, signed release) turned out to check the assertion rather than the reality. Each time, the remediation ran through the same vendor whose loader broke the assumption. Nobody outside the vendor was positioned to know the promise was empty until an external researcher looked.

The AFTA and verified-feed argument we run at TensorFeed cuts the other way. If an agent-facing artifact carries a signed receipt the caller can verify offline, the failure mode where the loader silently accepts non-matching content stops being invisible. It becomes a signature check that fails or passes. Plugin4Shell is a worked example of what a plugin ecosystem looks like without that verifier: the fetcher trusts itself, and the developer trusts the fetcher, and neither trust is checked.

Caveats Worth Naming

AIR Security assessed no exploitation in the wild. No CVE has been assigned as of publication. Vendors were notified in June 2026, giving roughly a three-month window between private disclosure and public writeup, which is inside the norm for coordinated disclosure on this class of bug. Anthropic and OpenAI patched inside a day of the public writeup on their product lines only; agents shipped by other vendors on top of their model APIs may or may not carry the fix, and end-of-line detection is on the downstream vendor. Nothing in the disclosure says a specific developer, tenant, or organization was compromised.

Microsoft may ship a fix in the days after this piece runs, and the delay so far may reflect the Bitbucket, GitLab, and self-hosted plugin host inventory question rather than reluctance. Google's retirement of Gemini CLI predates the disclosure by a small window; whether the retirement was a response to Plugin4Shell or a coincidence is not public. And no disclosure on this shape can measure the tail of small agent products with plugin systems that inherited the same assumption from the same handful of open-source examples the four large agents did.

Our Take

The number that matters is two. Two of the four largest coding agents on the market treated a supply-chain compromise as a patchable defect on a product they defend, and two did not. The split does not indict the two silent vendors. Microsoft may still ship a fix, and Google may still make Antigravity CLI a durable replacement. What the split does is expose the fact that the coding agent, the highest-privilege piece of software on a developer laptop this year, sits inside four separate governance models, and the response to a shared bug is a legibility test for each. The two vendors who read the bug as urgent are the two who priced the agent as a stand-alone product line. The two vendors who did not are the two treating the agent as either a platform layer or an experiment.

For builders on any of these four surfaces, the practical read is three-part. Audit whether your fleet is on Claude Code 2.1.179 or Codex 0.146.0 or higher, since the fix does not backport itself. Assume Gemini CLI installs are permanently exposed and remove them from any developer machine that still has one, since a product Google will not patch is not a product a security engineer can defend. Treat GitHub Copilot plugin traffic as higher risk than it was on Wednesday and audit the plugin repository allowlist for anything pinning to a tag rather than an immutable SHA, since Microsoft has not yet supplied a client-side fence.

For the governance conversation running through the last two weeks (the pacing accord essays, the three-lab standards body talks, the R&D Automation Index, the Microsoft MAI Code of Conduct), Plugin4Shell is the reality check. Every one of those voluntary artifacts is authored at the model layer. None of them binds the plugin ecosystem, the harness layer, or the coding agent's privilege on a laptop. This bug lived in the layer the voluntary-governance stack does not touch, and the response is running vendor by vendor at whatever tempo each vendor chooses. The pacing conversation asked whether the labs should slow down the model. The Plugin4Shell response asks whether the coding agent shipped on top of it can hold pin integrity for a full workweek.

Three signposts for the next 60 days. First, whether Microsoft publishes a patched Copilot client that fences the Bitbucket, GitLab, and self-hosted plugin hosts before the end of Q3, since each additional week widens the ratio of exposed-to-patched installs by userbase, not by product count. Second, whether any coding agent ships an independent, signed content-verification receipt for plugin installs, since a plugin manager that hands the caller a signature the caller can check offline is the class of fix Plugin4Shell would not survive twice. Third, whether MITRE assigns a CVE and NVD scores the bug at a severity that forces enterprise procurement teams to update their coding agent allowlists, since the CVE is the artifact that shows up in vulnerability management tooling and the absence of one is how a shipped patch fails to reach the fleets that need it. Two of the three fire, and Plugin4Shell becomes the first supply-chain bug the coding-agent layer actually institutionalizes around. None fires, and the next Plugin4Shell finds the same silent vendors on the same day.