---
title: "Plugin4Shell: Plugin Pin Bypass in AI Coding Agents"
url: https://erroneo.us/security/briefs/plugin4shell-ai-agent-plugin-sha-pin-bypass/
description: "A plugin repo can defeat SHA pinning in Claude Code, Codex, Copilot and Gemini CLI. Fixed in Claude Code 2.1.179 and Codex 0.146.0; Copilot, Gemini CLI unfixed."
type: security-brief
section: "Security Digest"
date_published: 2026-09-17
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2026-86063"]
severity: "high"
exploited: "none-known"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Plugin4Shell: Plugin Pin Bypass in AI Coding Agents

**Verdict: Check exposure.** Claude Code and Codex users on current versions are fixed; the real exposure is Copilot or Gemini CLI plugins that auto-update from repositories hosted outside GitHub.

- **Who must act:** Teams that install third-party plugins in GitHub Copilot or Gemini CLI, run Claude Code older than 2.1.179 or Codex older than 0.146.0, or run an internal plugin marketplace on Bitbucket or a self-hosted git server.
- **Who can relax:** Claude Code and Codex users on auto-update with no Copilot or Gemini CLI plugins, and anyone who installs no third-party agent plugins at all.
- **Affected:** Claude Code before 2.1.179 (and the Claude Desktop plugin install flow, per Anthropic); OpenAI Codex before 0.146.0; GitHub Copilot plugin installs (no client fix at disclosure on Sep 17, 2026); Gemini CLI (deprecated; Google will not patch)
- **Fixed:** Claude Code 2.1.179; Codex 0.146.0 (release notes: 'Verify Git plugin SHA checkouts', #34644)
- **CVEs:** CVE-2026-86063
- **CISA KEV:** no · **Exploitation:** No known exploitation

## What to do

1. Confirm versions: claude --version should report 2.1.179 or later and codex --version 0.146.0 or later; update with claude update or npm i -g @openai/codex@latest.
2. Inventory installed agent plugins and the git host behind each plugin and marketplace; flag anything on Bitbucket or a self-hosted server.
3. For Copilot, disable automatic plugin updates where you can and remove plugins sourced from hosts that allow SHA-shaped branch names.
4. Plan a migration off Gemini CLI; Google directs users to Antigravity instead of patching.
5. If you run an internal marketplace, host plugins only where 40-hex branch names are rejected, and make install tooling check that git rev-parse HEAD equals the pinned SHA.

### How to check if you are affected

- In each plugin checkout, list branches named like a commit hash or FETCH_HEAD: git -C <plugin-dir> for-each-ref --format='%(refname)' | grep -E '/([0-9a-f]{40}|FETCH_HEAD)$'
- Compare git -C <plugin-dir> rev-parse HEAD with the SHA pinned in the marketplace manifest; any mismatch means the pin was bypassed.
- Review recently updated plugins for new hooks, MCP servers or scripts that were not in the reviewed commit.

## What happened

On September 17, 2026, Air Security published [Plugin4Shell](https://www.air.security/blog-posts/plugin4shell). The flaw breaks the SHA pinning that plugin marketplaces for AI coding agents use to lock a plugin to a reviewed commit. Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI all cloned the plugin repository and checked out the pinned commit. None of them confirmed that the checkout actually landed on that commit.

Two git behaviors make that gap exploitable by whoever controls the plugin repository:

- **Claude Code, Codex, Copilot:** the attacker creates a branch whose name is the 40-character pinned SHA and makes it the default branch. Git prefers a ref over a commit with the same name, so `git checkout <sha>` lands on the attacker's branch.
- **Gemini CLI:** it fetches the pinned commit and then runs `git checkout FETCH_HEAD`. A default branch named `FETCH_HEAD` wins, and the fetched commit is discarded.

Air calls it zero-click because background plugin auto-update, the default in Claude Code and Codex, re-runs the checkout whenever the marketplace bumps the pin. The pinned commit can stay benign for review while the name resolves to malicious code. Air built working exploits for all four agents. It reports no exploitation in the wild, and the CVE is not in CISA KEV.

## Who is affected

Anthropic's advisory, [GHSA-pq7j-f95f-qfcv](https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv), covers the plugin install flow in Claude Code and Claude Desktop before 2.1.179. It was published on October 9, with [CVE-2026-86063](https://www.cve.org/CVERecord?id=CVE-2026-86063) following on October 13. The CVE record scores it CVSS 4.0 7.5, and the GitHub advisory 7.7. Anthropic says auto-updating installs already have the fix. Codex fixed it in [0.146.0](https://github.com/openai/codex/releases/tag/rust-v0.146.0), released July 29, whose changelog lists "Verify Git plugin SHA checkouts" (#34644). At disclosure, Microsoft had shipped no client fix for Copilot. Google has declined to patch Gemini CLI, which is deprecated in favor of Antigravity.

## Do you really need to act?

Only if you use third-party agent plugins, and the urgency depends on where they are hosted. The branch-name variant needs a host that accepts 40-hex branch names. Air notes that GitHub rejects them, while Bitbucket and self-hosted git servers allow them. Plugins hosted on GitHub are therefore out of reach of that variant. The Gemini CLI variant does not depend on the host, as the [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-plugin4shell-ai-coding-agent-supply-chain/) points out.

The realistic attacker publishes a useful plugin, gets it approved, and later swaps the code, or takes over a trusted plugin's repository. Air's earlier research is a warning about scale: a test plugin of theirs reached more than 26,000 agents before it was pulled.

## What to do now

1. Check `claude --version` (2.1.179 or later) and `codex --version` (0.146.0 or later). Update with `claude update` or `npm i -g @openai/codex@latest`.
2. List every installed plugin and marketplace and the git host behind each. Anything on Bitbucket or a self-hosted server needs a closer look.
3. For Copilot, disable automatic plugin updates where possible and remove plugins you cannot verify. That removes the zero-click element.
4. Move Gemini CLI users to a maintained tool.
5. If you run an internal marketplace, add the check Air suggests to your install tooling: `test "$(git rev-parse HEAD)" = "<pinned-sha>" || exit 1`.

## How to tell if you were hit

In each plugin's local git checkout, look for hash-named or `FETCH_HEAD` branches with `git for-each-ref --format='%(refname)' | grep -E '/([0-9a-f]{40}|FETCH_HEAD)$'`. Compare `git rev-parse HEAD` with the pin in the marketplace manifest. A mismatch means the pin was bypassed, so treat the plugin's code as untrusted and review what it ran. For Claude Code, the [plugin loading reference](https://code.claude.com/docs/en/plugins/loading) puts marketplace clones under `~/.claude/plugins/marketplaces/` and installed copies under `~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/`. Also look for hooks, MCP server entries or scripts in recently updated plugins that the reviewed commit did not contain.

## Timeline

- May 2026 — Air Security finds the flaw and builds proofs of concept for all four agents.
- Jun 17, 2026 — Anthropic confirms the fix in Claude Code 2.1.179.
- Jul 29, 2026 — Codex 0.146.0 ships with plugin SHA checkout verification.
- Aug 4, 2026 — Google says Gemini CLI will not be fixed.
- Sep 17, 2026 — Air publishes Plugin4Shell. [Help Net Security](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/) reports it on Sep 18.
- Oct 9, 2026 — Anthropic publishes GHSA-pq7j-f95f-qfcv. CVE-2026-86063 is published on Oct 13.

## Sources

1. [Air Security — Plugin4Shell](https://www.air.security/blog-posts/plugin4shell)
2. [Anthropic — GHSA-pq7j-f95f-qfcv: Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code](https://github.com/anthropics/claude-code/security/advisories/GHSA-pq7j-f95f-qfcv)
3. [CVE record — CVE-2026-86063](https://www.cve.org/CVERecord?id=CVE-2026-86063)
4. [OpenAI — Codex rust-v0.146.0 release notes](https://github.com/openai/codex/releases/tag/rust-v0.146.0)
5. [Anthropic — Claude Code plugin loading reference (Find plugins on disk)](https://code.claude.com/docs/en/plugins/loading)
6. [Cloud Security Alliance — Plugin4Shell: SHA-Pinning Bypass Enables AI Coding Agent RCE](https://labs.cloudsecurityalliance.org/research/csa-research-note-plugin4shell-ai-coding-agent-supply-chain/)
7. [Help Net Security — Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/)

---
Source page: https://erroneo.us/security/briefs/plugin4shell-ai-agent-plugin-sha-pin-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt