STUPID-2026-0164
Plugin4Shell: a Git ref-resolution bug let attacker-controlled branches silently defeat commit-hash pinning in Claude Code, Codex, Copilot and Gemini CLI plugins
Why 6/10
Affects a widely used category of product across four major agents (scope 4), but nothing was actually lost since this is a disclosed, patchable flaw rather than a real breach (recoverability 0). Researchers demonstrated the exact ref-resolution bypass for each agent and two vendors shipped fixes, which is a controlled finding rather than a study (realisation 1); the substituted plugin code would run with the user's own developer-machine privileges (impact 1). No in-the-wild exploitation is reported.
- Scope
- 4/4
- Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
- Recoverability
- 0/3
- Nothing was lost
- Did it happen
- 1/2
- Demonstrated (proof of concept, reproduction, controlled test or near-miss) with no real victim reported
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-11-13
Instruction given
None from the developer beyond the normal act of installing or auto-updating a plugin that a marketplace had pinned to a specific, reviewed Git commit hash.
Expected behavior
An agent that pins a plugin to a 40-character commit hash and checks it out should run the exact code at that commit — the entire point of pinning is that a reviewed hash cannot be silently swapped for different code later.
Actual behavior
Claude Code, Codex and GitHub Copilot resolve the pin with `git checkout <SHA>`. An attacker who controls the plugin repository can create a branch whose name is identical to the pinned hash and make it the repository's default branch; when the reference is ambiguous, Git can resolve to that branch instead of the commit, so the agent checks out attacker-controlled code while still reporting the pin as intact. Gemini CLI instead runs `git fetch origin <SHA>` followed by `git checkout FETCH_HEAD`, which an attacker can redirect the same way by naming the default branch `FETCH_HEAD`. None of the four agents verify, after checkout, that the resulting working tree actually matches the pinned hash. Claude Code and Codex enable plugin auto-update by default, so the substitution can take effect with no user interaction at all.
Damage
A disclosed, reproducible supply-chain bypass, not a reported real-world breach. Security firm Air privately reported Plugin4Shell to Anthropic, OpenAI, Microsoft and Google in June 2026 and disclosed publicly on September 17-18, 2026. Anthropic shipped a fix in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Microsoft had not patched Copilot at disclosure, and Google declined to patch the now-deprecated Gemini CLI, pointing users to Antigravity instead. No CVE had been assigned at disclosure and no in-the-wild exploitation was reported.
Full write-up
Plugin marketplaces for AI coding agents promise a specific safety property: a plugin is reviewed once, pinned to an exact Git commit hash, and whatever runs later is exactly that reviewed code. Security firm Air's "Plugin4Shell" finding, disclosed September 17, 2026, showed that promise was broken in four of the biggest agents at once — not through a flaw in the review process, but through a gap between pinning a hash and verifying it.
Claude Code, Codex and GitHub Copilot resolve a pinned plugin by running git checkout <SHA>. Git's reference resolution is ambiguous by design, and if an attacker who controls the plugin repository creates a branch with the exact same name as the pinned commit hash and makes it the repository's default branch, the checkout can resolve to that branch instead of the real commit — installing different, attacker-controlled code while the agent still reports the pin as satisfied. Gemini CLI uses a different two-step sequence, git fetch origin <SHA> then git checkout FETCH_HEAD, which the same technique defeats by naming the default branch FETCH_HEAD. In every case, the missing step is the same: none of the four agents check, after the checkout completes, that the working tree they ended up with actually matches the hash they pinned. Because Claude Code and Codex both auto-update plugins by default, the substitution can run with no prompt and no user action at all.
Air reported the flaw to Anthropic, OpenAI, Microsoft and Google in June 2026, two months before publishing. Anthropic patched in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Microsoft had not fixed Copilot at disclosure time, and Google told Air it would not patch Gemini CLI at all, since the product is being deprecated in favor of Antigravity. No exploitation in the wild has been reported — this is a responsible-disclosure finding against a widely trusted safety mechanism, not a documented breach — but it leaves two of four affected agents without a fix as of publication.
Classification
- Agent
- Multiple agents
- Failure mode
- Security Vulnerability
- Root cause
- Logic Error
- Domain
- Security
- OWASP Agentic Top 10 (our mapping)
- ASI05 Unexpected Code Execution (RCE) list
- Source
- Security Research
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0164: Plugin4Shell: a Git ref-resolution bug let attacker-controlled branches silently defeat commit-hash pinning in Claude Code, Codex, Copilot and Gemini CLI plugins." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0164/ (accessed 2026-11-13). CC BY 4.0.
← STUPID-2026-0163By ID
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.