Plugin4Shell is a SHA-pinning bypass in AI coding agent plugin installers, disclosed by researchers at Air Security on September 17, 2026: the agent checks out the commit a marketplace pinned, but never verifies that the checkout actually landed there, so whoever controls a plugin's repository can serve different code while the pin still looks honored. The researchers built working exploits against Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI, and because Claude Code and Codex auto-update plugins from their built-in marketplaces in the background, a swapped plugin can reach an already-installed victim with no prompt and no click. The result is remote code execution with whatever access the agent has.

The mechanism is a Git edge case. Git allows a branch to be named like a 40-character commit hash, and when a name matches both a branch and a commit, git checkout prefers the branch. An attacker who controls a plugin's repository creates a branch named exactly like the pinned SHA, makes it the default branch, and points it at malicious code — the install reports success at the pinned commit while running something else. Gemini CLI falls to a variant: it pins with git fetch and then runs git checkout FETCH_HEAD, which resolves to the branch instead if the repository's default branch is named FETCH_HEAD, silently discarding the fetched commit.

Patch status, per the researchers' disclosure: Anthropic fixed Claude Code in 2.1.179 and OpenAI fixed Codex in 0.146.0 — the Codex fix is visible in OpenAI's own 0.146.0 release notes ("Verify Git plugin SHA checkouts"), while Claude Code's 2.1.179 release notes don't mention it, so that account rests on the researchers. Air says Microsoft has shipped no Copilot fix, and that Google will not patch Gemini CLI, which it is retiring in favor of Antigravity. The Hacker News reported on September 18 that no CVE had been assigned and none of the four vendors had published a security advisory.

One important limit: GitHub rejects hash-shaped branch names, so plugins installed from GitHub-hosted repositories are not exposed to the branch variant — and The Hacker News found that every plugin in Anthropic's community catalog and the default Claude Code and Copilot catalogs points to GitHub. The exposure concentrates on Bitbucket and self-hosted Git backends, which the agents officially support, and on Gemini CLI's FETCH_HEAD variant, which GitHub's naming rule does not clearly block.

Why does SHA pinning keep failing like this?

SHA pinning is the industry's standard answer to the rug pull: review the code once, pin the reviewed commit, and trust that the pin is what runs forever after. Plugin4Shell shows the structural weakness in how that answer gets implemented. The pin is a promise recorded in one place — the marketplace manifest — and enforced in another: a Git client on the user's machine that was never actually asked to enforce it. Every affected agent ran the checkout and trusted that a successful checkout meant the pin was honored. None of them ran the one assertion that closes both variants: after checkout, resolve what is actually in the working tree and abort unless it equals the pin — in Git terms, test "$(git rev-parse HEAD)" = "<pinned-sha>".

That gap between the approved artifact and the running artifact is not unique to plugins. It is the same class of failure as the MCP rug pull, where a tool server changes a tool's description or schema after an admin trusted it. In both cases the review happened at one point in time, the artifact kept a mutable path back to its author, and nothing at load time or call time re-checked that what was approved is what showed up. Review-time trust with no execution-time verification is a design pattern, and Plugin4Shell is what it looks like when four independent teams all reach for it.

The disclosure also lands on the distribution layer rather than the model or the agent — the researchers describe it as an attack on the marketplaces through which agent add-ons reach millions of machines. Their earlier work claimed a fake skill reached roughly 26,000 agents after passing marketplace review, which is the adoption step this bypass weaponizes. And because the pin is resolved inside the agent, the researchers conclude, a marketplace cannot fully fix it: only the agent can verify its own checkout.

What should teams check now?

Update first: Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Then inventory where your plugins actually come from. Any plugin or internal marketplace pinned to a Bitbucket or self-hosted Git repository is in the exposed configuration for the branch variant; GitHub-hosted sources are not, for the three agents that check the pinned commit out directly. For Copilot there is no patch to apply, so that inventory is the control — Copilot can install plugins from non-GitHub hosts, which is where Air says the risk sits. Gemini CLI installs stay vulnerable per the researchers; Google and Air both point users to Antigravity.

Check auto-update behavior while you're there. Background plugin auto-update is what makes this zero-click, and — per The Hacker News's read of Anthropic's and GitHub's documentation — it is on by default for the agents' own GitHub-hosted marketplaces but off or optional for outside ones. Confirm the setting in your own fleet rather than assuming. If you run any homegrown installer that pins Git dependencies by SHA, add the post-checkout assertion above. Then ask the broader question of every agent surface you run: after something is reviewed and approved, does anything verify it again at load time?

How Waxell handles the drift class

Honestly scoped: the fetch of plugin code over Git is not an MCP tools/call, so it does not traverse an MCP gateway — Waxell's included. Plugin4Shell's install path sits outside the MCP protocol entirely, which is why the fix had to ship inside the agents.

What Waxell does govern is the same failure class on the MCP surface: a tool that changes after you approved it. The Waxell MCP Gateway fingerprints every tool it has seen across connected upstreams — hashing each tool's name, description, and input schema — and tracks each one through five trust states: Pending review, Drift detected, Trusted, Blocked, and Removed. A newly discovered tool surfaces as Pending review and cannot be called through the gateway until an admin approves it. When a trusted tool's fingerprint changes, it moves to Drift detected at the next discovery refresh and resurfaces for review, and its new description is re-scanned for prompt injection at fingerprint time — before any agent calls the updated version.

Detection and enforcement are distinct, and the distinction matters after an incident like this one. On the Gateway, blocking drifted tools is a policy rule you author: the deny_drift action blocks calls to tools whose fingerprint changed since last approved, and Waxell's own starter rule set recommends enabling it everywhere. Policy rule changes take effect across the gateway fleet within seconds, and every decision — the call, the rule that fired, the resolved human identity behind the agent — lands in a payload-free audit log. That is execution-time verification of the thing Plugin4Shell exploited the absence of: a check, at the moment of use, that what you approved is still what you're getting. For how the drift attack works on MCP servers specifically, see our breakdown of the MCP rug pull attack, and for vetting upstreams before you connect them, the MCP server evaluation checklist.

FAQ

What is Plugin4Shell?

Plugin4Shell is a vulnerability class disclosed by Air Security on September 17, 2026, in which AI coding agents check out a marketplace-pinned plugin commit without verifying the checkout landed on that commit. A repository owner can exploit Git's preference for branch names over commit hashes — or a default branch named FETCH_HEAD, in Gemini CLI's case — to substitute malicious code behind an honored-looking pin.

Which agents are affected, and which versions fix it?

Claude Code (fixed in 2.1.179, per the researchers), OpenAI Codex (fixed in 0.146.0, confirmed in OpenAI's release notes), GitHub Copilot (no fix shipped as of the September 17 disclosure, per the researchers), and Gemini CLI (no fix planned, per the researchers; Google is retiring it and pointing users to Antigravity).

Are plugins installed from GitHub affected?

Largely not, for the branch variant: GitHub rejects branch names that look like commit hashes, and The Hacker News found the agents' default catalogs point to GitHub-hosted repositories. Exposure concentrates on Bitbucket and self-hosted Git backends, which the agents support, and on the Gemini CLI variant, which GitHub's rule does not clearly block.

Is Plugin4Shell the same thing as an MCP rug pull?

Same failure class, different surface. An MCP rug pull changes a tool's description or schema on a connected server after approval; Plugin4Shell changes plugin code behind a pinned commit after review. Both exploit trust established once at review time and never re-verified at use time.

Does a marketplace fix this?

No marketplace can fully fix it, because the pin is resolved inside the agent on the user's machine. A marketplace can reduce exposure by only accepting repositories on hosts that reject hash-shaped branch names, but the complete fix — verifying the resolved checkout against the pin — has to ship in each agent.

Does Waxell prevent Plugin4Shell?

No. Plugin installation happens over Git, outside the MCP protocol, so it is outside what an MCP gateway sees. The Waxell MCP Gateway addresses the adjacent risk on the MCP surface: tools that change after approval are fingerprint-tracked, moved to Drift detected, and — with a deny_drift policy rule in place — blocked until re-approved.

Sources

• Air Security (Or Nevo, Dor Granat, Niv Hoffman), "Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents", September 17, 2026

• The Hacker News, "Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents", September 18, 2026

• OpenAI, "Codex 0.146.0 release notes", including "Verify Git plugin SHA checkouts" (#34644)

• Anthropic, "Claude Code CHANGELOG, 2.1.179"

• Hacker News, "discussion thread", September 18, 2026

Your agents' tool calls deserve the check their plugin installs didn't get. Start free with the Waxell MCP Gateway — every tool on every connected upstream is fingerprinted at discovery, and a deny_drift rule is one policy away.