Plugin4Shell broke SHA pinning on four coding agents. For a small team, the homework is version inventory and post-checkout hash verify, not a CVE hunt.

The coding-agent story for Tuesday, September 22, 2026 is a distribution-layer miss, not a model miss. Air Security published Plugin4Shell on Thursday, September 18. Jessica Lyons at The Register reported it first. The Next Web published a clear analysis on Monday, September 21. The claim is simple and ugly: four widely used AI coding agents pinned marketplace plugins to a commit hash, then trusted the checkout without checking what actually landed in the working tree.

I want the timeline separated before anyone collapses it into "disclosed today." Air built a working proof of concept in May 2026 and disclosed to the four vendors in June. Anthropic confirmed a fix around June 17 in Claude Code 2.1.179. Google said around August 4 that it would not ship a Gemini CLI fix. Codex was verified fixed around August 12 at 0.146.0. Air went public Thursday. TNW's piece is Monday. Those are different days. Treat them that way.

This is also not the September 12 RubyGems rogue-agent note, not the September 19 Gemini Irregular CTF breakout, not the September 10 METR cyber incidents note, and not yesterday's Buist antitrust filing. Those stay on their own pages. Plugin4Shell is the plugin marketplace pin and the checkout verify that never happened.

What broke, and what did not

Marketplace plugins are supposed to be safer because a catalogue pins each plugin to one reviewed commit. Review once, pin the 40-character hash, and the agent should keep installing that exact tree. Air found the agents ask for the pin and then fail to confirm the tree they got.

Git allows a branch to carry almost any name, including a string that looks exactly like a commit hash. When a name is both a valid branch and a valid object, git can prefer the branch. Whoever controls the plugin repository can create a branch named after the pinned hash, point it at different code, and let the agent install that tree while reporting a clean pin. Claude Code and Codex auto-refresh plugins by default, so the victim does not need to click install again. A plugin runs with the developer's access, which is why Air calls it zero-click remote code execution in the agent context.

Gemini CLI fails a different way. It fetches the right commit, then a checkout path can be captured by a default branch named FETCH_HEAD, so the correct tree never reaches disk. The durable fix Air describes is one line of discipline: after checkout, resolve what sits in the working tree and abort unless it matches the pin.

GitHub told The Register that github.com rejects hash-shaped branch names, which blocks that branch trick on GitHub-hosted remotes. Air's reply matters for operators: marketplaces can sit on Bitbucket or on a company's own git server, both of which still allow hash-shaped names, and Anthropic's docs list those hosts as valid marketplace backends. Copilot can use those hosts too. Microsoft had shipped no Copilot fix as of the September 21 TNW report. Do not write that Copilot is patched. Do not write that Gemini CLI is patched. Google is retiring Gemini CLI and pointing people at Antigravity, which this pin bypass cannot land on because it has no plugin pin path to beat.

How much of this reaches a five-person shop

The scary headline is four agents. The useful narrowing came from The Hacker News. Swati Khandelwal checked the default marketplaces on September 18 and found that every plugin in Anthropic's community catalogue, and in the default catalogues for Claude Code and Copilot, pointed at a GitHub repository. On GitHub-hosted defaults, the hash-shaped branch trick is what GitHub says it blocks. Background auto-update is also the piece that makes the attack zero-click, and that path is strongest on the agents' built-in catalogues.

That narrowing is not a free pass. Teams still install from Bitbucket or self-hosted remotes. Teams still run older Claude Code or Codex builds. Teams still have Gemini CLI installed after Google's retire-without-patch stance. Teams still treat "marketplace reviewed" as if it were a working-tree guarantee. It is not. The pin is only as strong as the post-checkout hash verify.

As of the September 18 Hacker News check there was no CVE identifier and no security advisory from the four vendors. Anthropic's 2.1.179 notes did not mention the fix, so Air's post is the public account that it exists. There is no sign of real-world exploitation in the published accounts. Do not invent active exploitation to make the post feel urgent. The urgency is inventory and verify, not theater.

One open question the write-ups leave on the table: whether updating an affected agent removes a plugin that was already swapped, or only stops the next swap. Until your vendor says otherwise in writing, assume you may need to reinstall or re-verify plugins after you bump the agent, not just bump and walk away.

The small-team file

You do not need a CVE number to act. You need a short operator file.

1. Inventory agent versions on every laptop and CI image. Record Claude Code, Codex, Copilot, and Gemini CLI. Require Claude Code >= 2.1.179 and Codex >= 0.146.0 where you still run those tools. Anything older is an open item, not a "we'll get to it" note.

2. Inventory marketplace backends. For each agent, write down whether plugins come only from GitHub-hosted default catalogues or also from Bitbucket or self-hosted remotes. GitHub's branch-name rejection helps the GitHub-only case. It does not cover the other backends Air named.

3. Treat Gemini CLI as a retire path. Google said it will not patch. Prefer Antigravity or another non-plugin path where this bypass cannot land. Count remaining Gemini CLI installs the way you would count any other end-of-life tool still on disk.

4. Make "pin" mean post-checkout hash verify. If your install path cannot show that the working tree hash matches the pin after checkout, the pin is a label, not a control. Prefer vendors and workflows that abort on mismatch. "Marketplace reviewed" is necessary and not sufficient.

5. Watch auto-refresh defaults. Claude Code and Codex refresh plugins by default. Know whether that is on for your seats, and which catalogue it refreshes from. Silent refresh is convenient until the refresh is the install path.

6. Keep this separate from last week's supply-chain notes. RubyGems rogue agents, Gemini Irregular, and METR cyber are adjacent themes with different actors and different fixes. Do not merge them into one remediation ticket.

If you want a calm second set of eyes on how this lands in a small-team vendor file, DefendResolutions is built for that kind of operator work.

What not to write

Do not write that Copilot or Gemini CLI are patched. Do not write that the bug was disclosed today. Do not write that there is known active exploitation. Do not collapse May PoC, June disclosure, summer patches, the September 18 Air post, and the September 21 TNW analysis into one day. Do not fold this into the September 12, 19, 10, or 21 posts. The homework is version inventory, backend inventory, Gemini CLI retirement, and post-checkout hash verify.