Plugin4Shell Can Bypass Plugin SHA Pins for Zero-Click Code Execution Across Four Coding Agents

Analysis of Plugin4Shell, a demonstrated plugin SHA-pinning bypass affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI.

Claude Code, Codex, GitHub Copilot, and Gemini CLIGovernance bypassPlugin supply-chain SHA-pinning bypass and zero-click code executionDeveloper workstations running coding agents with marketplace plugins installed from attacker-controlled or compromised repositories

What happened

In controlled proofs of concept, the affected coding-agent clients resolved an attacker-controlled branch instead of the marketplace-pinned commit and installed the substituted plugin code; background update made the Claude Code and Codex paths zero-click for an already-installed plugin.

Why it matters

Successful exploitation would execute attacker-controlled plugin code on a developer workstation with the permissions and reachable systems available to the coding agent. The public sources describe controlled demonstrations, not confirmed malicious exploitation in production.

Missing authorization check

Client-side verification that the resolved Git HEAD exactly equals the approved commit, plus independent authorization before plugin installation, plugin update, and consequential actions by the resulting runtime.

Would PP block it?

A compromised coding-agent process may still read ungated local data or execute within its host permissions. Where merges, deployments, protected credential use, publication, or infrastructure changes are routed through Permission Protocol, the substituted plugin cannot authorize those actions by itself and must present a receipt bound to the exact action and signer.

Incident analysis

Timeline and technical read

Timeline

2026-05
AIR Security reports finding the flaw and building working proofs of concept against all four coding-agent plugin systems.
2026-06
AIR reports coordinated disclosure to Anthropic, OpenAI, Microsoft, and Google.
2026-06-17
AIR records Anthropic confirming the fix in Claude Code 2.1.179.
2026-08-04
AIR records Google saying deprecated Gemini CLI would not receive a fix and advising migration to Antigravity.
2026-08-12
AIR verifies OpenAI Codex 0.146.0 as fixed.
2026-09-17
AIR publishes Plugin4Shell; contemporaneous reporting independently summarizes the mechanism and vendor status.

Technical breakdown

Claude Code, Codex, and GitHub Copilot cloned a plugin repository and requested the pinned SHA without verifying the resulting HEAD. On Git hosts that permit 40-hex branch names, an attacker-controlled default branch matching the pin could win Git's ambiguous ref resolution.
Gemini CLI fetched the pinned commit and then checked out FETCH_HEAD. AIR demonstrated that a repository whose default branch was named FETCH_HEAD could redirect that checkout to attacker-controlled branch content.
AIR states that Claude Code and Codex update installed plugins in the background by default, allowing a changed marketplace pin to trigger installation without a new click from the user.
The proposed invariant is client-side: resolve the checked-out HEAD and abort unless it equals the approved commit. Marketplace review alone cannot enforce what the local client ultimately executes.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Governance bypass. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at: Outside the coding-agent host, before protected credentials and consequential deployment, publication, or infrastructure actions
Still needs: Plugin resolver integrity, host compromise prevention, local file confinement, and any downstream capability that bypasses the authorization gateway
Receipt required for: Plugin installation or update and downstream use of protected credentials, merge, deploy, publish, or infrastructure-mutation authority

Permission Protocol does not repair the vulnerable Git resolution or prevent malicious plugin code from starting, but an external Runtime Gate can deny consequential actions that lack a separately authenticated receipt.

Related incidents and controls

High2026-06-23

Fake AI Agent Skill Bypassed All Security Scanners and Reportedly Reached 26,000 Agents via Staged External Payload

High2026-06-22

23 ClawHub Plugins Published Under Official @openclaw/ and @clawhub/ Scopes by Unauthorized Accounts, Exposing Claude Code and Cursor to Supply Chain Risk

High2026-07-27

Stolen Maintainer Token Injected Credential-Stealing Malware into ADLC Team Skills Repository

Critical2026-02-05

ClawHavoc: 1,184 Malicious Skills Uploaded to OpenClaw ClawHub Marketplace Delivering Atomic Stealer Targeting API Keys, SSH Creds, and Browser Passwords

AI agent compliance controls Signed audit evidence

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop