The plugin you reviewed and pinned can still be swapped under you
On 17th Sep'26, researchers at AIR disclosed Plugin4Shell, a flaw shared by Claude Code, Codex, GitHub Copilot and Gemini CLI. It breaks SHA pinning, the mechanism that locks an installed plugin to one reviewed version of its code. All four agents check out the pinned commit without verifying the checkout landed there, so an attacker who controls the repository behind a plugin can serve different code while the pin still looks intact. No click is needed, because the same checkout re-runs on background auto-update, which is the default in Claude Code and Codex. A plugin inherits the reach of the developer running the agent, including local source, cloud credentials, SSH keys and internal repositories. AIR had already shown the takeover half works, finding 925 hijacked skills in active use across 134,000 agents. Anthropic patched Claude Code in version 2.1.179 and OpenAI patched Codex in 0.146.0. Microsoft has shipped no fix for Copilot. Google is not patching Gemini CLI because it deprecated the product, so every remaining install stays exposed.
What it actually means
The victim here did everything the security model asked, right down to pinning the reviewed commit. The pin was the control, and the agent never checked it had held, so the review you did applies to code that may no longer be the code that runs. It is worth a version check this week on any machine where you have installed agent plugins, and worth turning background auto-update off on an agent that holds production credentials.
The harder half is the vendor split. Two of the four fixed it, Microsoft has not, and Google answered by retiring Gemini CLI rather than patching it, which leaves the people still running it with migration as their only route out. If your agent is where your keys live, then whoever makes that agent is part of your security posture, and that is worth checking before the next disclosure rather than after it.
The pin was a claim the agent never checked.
2 of 4major coding agents patched after the disclosure
Source: Help Net Security (reporting AIR) · Saturday, 19 September 2026