A Single Git Trick Beats AI Coding Agents' Safety Locks
Air Security reveals a vulnerability, Plugin4Shell, affecting four widely used AI coding agents: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI. This zero-click remote code execution exploit allows attackers to swap a plugin's reviewed code with malicious code, requiring no action from the victim.
The Issue
Initially, the AI industry addressed plugin marketplace poisoning by locking plugins to one reviewed code version. However, Air Security's research demonstrates that this lock has now been compromised.
How It Works
Coding agents install add-ons (plugins) from marketplaces, which pin each plugin to a commit hash—a unique 40-character identifier. Typically, agents should run the same audited code indefinitely after reviewing the pinned snapshot.
Air Security found that agents fail to verify the received code. Git allows branches to have names resembling commit hashes. An attacker can create a branch with the pinned hash name, point it to different code, and make it the default. The agent, believing it's using the reviewed code, installs and runs the attacker's code instead.
Gemini CLI's Unique Vulnerability
The Gemini CLI breaks differently. It fetches the correct commit but runs a checkout based on a default branch named FETCH_HEAD, potentially overwriting the intended code.
The Fix
The solution is a single line of code: after checking out the code, resolve the actual content in the working tree and abort if it doesn't match the pin.
No User Interaction Required
Agents auto-update in the background, meaning the attack doesn't need user intervention to install new plugins. It replaces existing, trusted plugins with malicious code during routine updates.
GitHub's Mitigation
GitHub states that its users are not vulnerable due to its rejection of branch names resembling commit hashes. However, Air Security argues that marketplaces can be hosted elsewhere, such as on Bitbucket or private servers, where this vulnerability still exists.
The Bigger Picture
This exploit highlights the risks of excessive agency, a concern OWASP placed third in its 2026 top ten.