"Plugin4Shell": A Branch Named Like a Commit Hash Swaps Pinned Plugins in Claude Code, Codex, Copilot, and Gemini CLI

Plugin marketplaces and plugin installation in Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI

Air Security published Plugin4Shell on September 18, 2026, a zero-click remote code execution path that defeats the SHA pinning these agents use to lock a reviewed plugin to a specific commit. The agents fetch the pinned reference but never check that the code they end up with matches it, so a repository owner can create a branch whose name is the pinned commit hash and git resolves the name to the branch instead. Claude Code, Codex, and Copilot share this branch-naming variant; Gemini CLI is vulnerable through a separate checkout path. It is zero-click because the same checkout re-runs on background auto-update: "when the marketplace bumps the pinned SHA, the swap reaches already-installed plugins with no user action." Air found the bug in May and reported it in June. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Microsoft shipped no fix for Copilot despite June notification; Google will not patch Gemini CLI and directs users to Antigravity. No CVEs had been assigned at publication. Air's earlier research had shown a malicious plugin reaching 26,000+ agents

Integrity pinning expressed as a git reference that git is free to resolve to something else, then trusted without comparing the fetched content to the pin. Auto-update removes the one moment a human might have looked