Coding agents pin a commit and never check they got it

Claude Code, Codex, Copilot CLI and Gemini CLI all check out marketplace plugins at a pinned commit SHA, and none of them verify the checkout matches that SHA. Security firm AIR disclosed the flaw, named Plugin4Shell, across all four agents on September 17 and 18.

The mechanic is plain enough to be embarrassing. The agent asks git for a commit, git returns something, and the agent trusts it. A repo owner who controls the remote can serve different code while the pin in your config still reads like a guarantee. AIR says it found the bug in May 2026 with working exploits against all four tools, reported it in June, and in a test run got 925 compromised skills to reach 134,000 agents.

The fixes split down the middle. Anthropic patched Claude Code in 2.1.179. OpenAI patched Codex in 0.146.0. Microsoft has shipped nothing for Copilot CLI. Google deprecated Gemini CLI instead of patching it, so every existing install stays exposed with no fix coming.

Upgrade Claude Code and Codex past those version numbers. For Copilot CLI and Gemini CLI, stop running plugins, don't just audit them. A deprecated tool with a known zero-click remote code execution hole in its plugin loader isn't something you manage carefully, it's something you stop using.

Claude Code 2.1.275 points at the actual fix: plugins from an npm source now get pulled with npm pack --ignore-scripts and integrity-checked, so an install script can't run at all. That's what a lockfile does for package managers, content hashes instead of bare references. If you run an internal plugin marketplace, add a post-checkout SHA assertion. It's four lines of shell and it closes the whole hole.