Plugin4Shell: Four AI Coding Agents Skipped the Check── The pin was recorded, but no one checked that the pinned code arrived; a report of verification and the fact of verification must be checked separately

On 17 September 2026, the Israeli security firm Air disclosed Plugin4Shell, a flaw that lets outside code run in four AI coding agents — Claude Code, Codex, GitHub Copilot and Gemini CLI — without the user pressing anything. When an AI agent reports that it has verified something, who has verified the verification? In all four products the pin was recorded but nobody checked that the pinned version actually landed, so users need their own way to separate a report of verification from the fact of it.

01Four AI coding agents never checked that the pinned version arrived

This case answers the opening question with unusual clarity. None of the four products checked.

Plugin4Shell is not a failure of model intelligence or of judgment. The defect sits in the procedure an AI agent follows when it pulls in an external extension, a plugin. On paper the procedure fixes the version by number: use this one. But after fetching, the agent never compared what it had received against the version that number names. Air, which found the flaw, describes it as a zero-click remote code execution bug shared by all four major coding agents.

The record is correct. The message says success. And the code inside can still be something else. There is one conclusion for readers to take away: treating an agent's "success" or "verified" message as proof that the work finished correctly is a practice that needs to change. The rest of this piece works through what happened, how far it reaches, why nothing stopped it, and what each vendor did.

02The flaw exploited Git's rule for resolving a branch named after a commit

The thing the previous section said went unchecked comes down to a combination of Git's documented behaviour and the agents' fetch procedure.

A plugin marketplace specifies which version to distribute with a 40-character commit ID. A commit ID is computed from the content of that version, so the same ID should mean the same content. The agent uses the ID to fetch that version from the plugin's repository.

According to Air and press coverage, if an attacker creates a branch in the plugin's repository whose name is exactly those 40 characters, the fetch reads the branch of that name rather than the commit. Git's documentation says that when a name is ambiguous, it applies a fixed sequence of rules and takes the first match. What happened here follows that rule. It is not a bug in Git.

It is worth drawing a boundary. The attack depends on the attacker being able to write to the plugin's repository — through a hijacked maintainer account, say, or a change in who controls the repository. This piece does not go into the attack steps. The point is not the mechanics but this: the "success" the agent reports at the end reflects only the fact that a number was specified.

03The exposure reaches every environment that runs with a developer's permissions

With the mechanism clear, the next matter is what it touches once it fires.

A plugin runs with the same permissions as the developer running the agent. Cyber Security News lists the reach as local source code, cloud credentials, SSH keys, internal repositories, production systems and secrets. Anything running on a developer's machine can reach whatever that developer can reach.

That reach does not stay inside the engineering team. Companies that bring AI coding agents into their work usually review them first: which product to allow, which plugins to permit, what access to grant. That review rests on an assumption that what was approved runs in the form it was approved. Plugin4Shell removes the assumption. The review approved a version pinned by number, and the code that actually runs can be different.

On the number of affected users, Air says "millions of agents". That is the discoverer's wording, not an independently counted figure. What is certain is that all four are leading coding agents, and plenty of development organisations use at least one of them.

04Background auto-update turned a skipped check into a zero-click intrusion

The breadth of permissions sets how bad the damage can be. But the reason an intrusion could go all the way through with nobody touching anything lies elsewhere.

It helps to split the cause in two. The first is the procedure already described, the missing landing check, common to all four products. On its own, that would limit harm to the moment a user installs or reinstalls a plugin. At that moment there is still some chance of noticing that something is off.

The second is automatic updating. According to Cyber Security News, Claude Code and Codex update installed plugins in the background by default. Once a user has installed a legitimate plugin, the product fetches new versions on its own. So if that legitimate plugin is later hijacked, the hijacker's code comes in while the user does nothing. There is no moment at which anyone could notice. That combination is what Air means by "zero-click".

Neither cause alone produces this outcome. With a landing check, automatic updates would stop at the mismatch. Without automatic updates, the unchecked fetch would still start only from a user action. When the two designs overlap, and a developer's broad permissions are added on top, a skipped check becomes an intrusion.

05Only two vendors shipped fixes; the other two have no confirmed fix

So what did each vendor actually do about those two causes? Here they are, laid out so they can be counted.

Air says it found the flaw in May 2026 and told the vendors in June. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. I was not able to confirm the Claude Code version number in the official changelog; it comes from the discoverer and press reports.

The other two responded differently. According to reports, Microsoft has not fixed Copilot despite being notified in June. GitHub, however, says it has mitigated the issue, so "unfixed" is the view of the discoverer and the press. Google announced on 4 August that Gemini CLI would be deprecated and did not fix the flaw.

The table shows an odd pairing. The two products in which auto-update makes the attack zero-click are also the two that shipped fixes. A mechanism for receiving updates also carries the fix to users. This pairing is what the table shows; it does not establish that auto-update is why those two vendors fixed the flaw. In the two products without a confirmed fix, the flaw should be treated as present unless the user acts.

06Treat the success message as a claim and verify the landing separately

Having established that only half the products were fixed, it becomes clear what users themselves have to decide.

There are three issues. The first is how to treat an agent's "success" message. None of the four products compared the message with the actual content. So the message is a report, not the result of a check. It cannot be used to judge completion; a separate step that compares what arrived is needed.

The second is the default for automatic updates. If the contents can change in the background after a one-time review at adoption, the review's conclusion does not last long. For products that update by default, someone has to decide whether to switch updates off or restrict what may be updated. Review is not a one-off event.

The third is what to do with products that will not be fixed. Copilot is unfixed in the discoverer's view, and Gemini CLI has no fix planned. Anyone who keeps using them has to decide on other controls — not installing outside plugins in those tools at all, or checking their content separately before use.

None of the three is settled by how clever the AI is. Checking where incoming components come from is already part of practice in NIST's Secure Software Development Framework. What is new is how often that check is now handed to an agent rather than a person, and how often the message reporting the result is simply believed.

07The same assumption may persist wherever agents pull in outside components

Are those three issues confined to these four products? The last step is to look at the scope.

What has been confirmed goes as far as this: the landing was not checked when plugins were fetched. Looking only at the structure, though, the pattern of naming an outside component by name or number, pulling it in, and reporting the outcome with a "success" message exists well beyond plugins. External tools the agent connects to, configuration it loads, endpoints it calls. In each case the record that something was specified and the fact of what arrived can come apart.

Whether the same kind of flaw exists there, whether it simply has not been found, or whether it is absent, has not been established. I set this down as inference. What is certain is that once one design that never compares the message with the content has been found, users can ask the same question of every other intake point.

What the adopting side can do is insert one matching step after the agent reports. Compare the version number with what actually arrived, limit the scope of automatic updates, and handle unfixed products separately. Then, if the same flaw turns up at another intake point, the means of separating report from fact is already in hand.

When the agents reported that they had verified the plugin, none of the four had verified it. The record of the pinned number was correct, and the message said success. Yet nobody had looked at whether what arrived was what had been specified.

Separate the report of verification from the fact of it. The adopting side has to own one step that checks what actually arrived. Handing work to an agent and checking the result of that work are two different jobs.