19 SEP 2026 — Four AI coding agents pinned their plugins to an exact commit hash, then never checked that the code they got back matched it.
Anthropic and OpenAI fixed the problem in June and August. Users were told on 17 September. GitHub Copilot has no fix, and Google will not write one.
How the pin fails
An agent installing a plugin does what a careful engineer would: it records a 40-character commit hash and asks git for exactly that commit. The intent is that the reviewed code is the code that runs.
The agents failed to account for a git rule about ambiguous names. If a repository contains a branch whose name is identical to that 40-character hash, git resolves the branch first. Someone who controls the plugin repository can create such a branch, point it at whatever they like, and the agent checks it out while reporting that it installed the pinned version.
AIR Security, which found the flaw and named it Plugin4Shell, describes the missing step precisely: the agents never verify that the resulting working tree matches the hash they asked for. Gemini CLI fails a variant of the same check, resolving a branch named FETCH_HEAD ahead of the commit it had just fetched.
What each vendor did
Anthropic shipped a fix in Claude Code 2.1.179 and confirmed it on 17 June. OpenAI's fix was verified in Codex 0.146.0 on 12 August. Both landed months before anyone outside the vendors knew there was a problem.
Google told the researchers on 4 August that it would not patch Gemini CLI, which it is retiring, and pointed users to its replacement. GitHub Copilot has no fix at all.
No CVE identifiers had been assigned when The Hacker News reported the disclosure on 18 September. The flaw carries no tracking number for anyone building a patch inventory.
Where the real exposure sits
GitHub does not permit branch or tag names that look like commit hashes, so a plugin hosted there cannot be attacked this way. That detail narrows the exposure considerably.
The exposure is concentrated in plugins hosted outside GitHub, on infrastructure the attacker controls or can compromise. That is a smaller population than the four agent names suggest. AIR Security's count of millions of affected agents describes installed agents, not exploitable plugin sources.
No exploitation has been observed. The researchers built working attacks in May and found no evidence that anyone else had.
Three months between fix and notice
The timeline is where the argument sits. AIR Security disclosed to all four vendors in June, and two fixed quickly. The public learned in September. By then, users of the patched agents had been safe for months without knowing why; users of the unpatched two had been exposed for months without knowing at all.
Coordinated disclosure exists to give vendors time to ship before attackers learn the technique, and on that measure it worked. It also means a Copilot user had no way to make an informed decision through July and August. That is the trade-off.
What is still unresolved
Copilot is the one to watch. It is the most widely deployed of the four and the only one that is neither patched nor retired, with no fix date given.
The second unresolved question is whether the pattern extends beyond plugins. The failure is not specific to AI agents. Any automated system that trusts a version pin without verifying what it received has the same problem; plugin installation is just where someone looked.
A CVE would help. Without one, the flaw is hard to track through the tools organisations use to decide what to patch, and a vulnerability nobody can reference is easy to ignore.
View author profile → · Editorial policy
