Plugin4Shell: SHA-Pinning Bypass Gives Zero-Click RCE Across Claude Code, Codex, Copilot, and Gemini CLI

Air Security (Or Nevo, Dor Granat, Niv Hoffman) published Plugin4Shell on 17 September 2026 (covered by The Register the same day and The Hacker News on 18 September): a plugin SHA-pinning bypass that turns marketplace installs into zero-click remote code execution on Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. Each agent checks out the marketplace-pinned commit but never verifies that HEAD actually landed on that commit. On Claude Code, Codex, and Copilot, an attacker who controls the plugin repo can create a branch whose name is the 40-hex pinned SHA, set it as the default branch, and exploit git's "refname is ambiguous" preference for a ref over an object id so checkout resolves to attacker-controlled content while the pin still looks honored — a pattern that works on hosts that allow SHA-shaped branch names (Bitbucket and self-hosted git; GitHub rejects those names). Gemini CLI's variant fetches the pin into FETCH_HEAD then runs `git checkout FETCH_HEAD`, which resolves to a default branch named FETCH_HEAD instead of the fetched commit. Plugin auto-update (default on Claude Code and Codex) makes the swap zero-click for already-installed plugins after a marketplace pin bump. Air disclosed to all four vendors in June 2026: Claude Code fixed in 2.1.179 (Anthropic confirmed 17 June), Codex fixed in 0.146.0 (verified 12 August), Gemini CLI will not be patched (deprecated; Google advises migrating to Antigravity), and Copilot remained unpatched at disclosure — GitHub argued GitHub-hosted marketplaces are safe because GitHub forbids SHA-like refs, while Air notes Copilot still supports Bitbucket/self-hosted marketplaces. No CVE was assigned as of the public disclosure.

You are affected if you run Claude Code < 2.1.179 (fixed in 2.1.179). Codex < 0.146.0 (fixed in 0.146.0). GitHub Copilot: unpatched at 17 Sep 2026 disclosure for non-GitHub marketplace backends. Gemini CLI: unpatched permanently (deprecated); migrate to Antigravity.. Versions 2.1.179 and later include the fix.

Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later immediately — those are the only complete agent-side fixes. For Copilot, prefer GitHub-hosted marketplaces only (GitHub rejects SHA-shaped branch names) and treat Bitbucket/self-hosted plugin marketplaces as exposed until Microsoft ships a client-side HEAD==pin check. Stop using Gemini CLI; move to Antigravity if you need Google's agent. Disable background plugin auto-update where the product allows it, pin and re-verify plugin trees yourself with `git rev-parse HEAD` after every install/update, and revoke/rotate credentials on any host that had marketplace plugins installed before the fixed floors. A marketplace cannot fully close this: the pin is resolved inside the agent.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code and which version, then enforce a policy on it.