Plugin4Shell: a pinned plugin is swapped in four coding agents
In shortA branch named like a commit hash let a marketplace serve different code than the commit a plugin was pinned to.
What happened
Researchers at AIR Security disclosed a flaw in the plugin systems of Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. The agents did not check that Git had checked out the commit a plugin was pinned to.
Git allows a branch name made of 40 hexadecimal characters, and prefers the branch when a name could be either. A marketplace could therefore serve other code in place of a pinned plugin, and with auto-update on, an installed plugin could change without a click.
Anthropic fixed Claude Code in 2.1.179 and OpenAI fixed Codex in 0.146.0. Reports differ on the status of Copilot and Gemini CLI.
Why it worked
Pinning to a commit is supposed to freeze what runs. The check that the pin was honoured was missing, so the pin gave a false sense of safety.
What EndLayer shows or does
- Available now
Which devices run each of the affected agents, so you know where to apply the fixed versions. Roadmap →
- Available now
Skills and commands listed per agent host, by name and origin; a skill you block fails the device. Roadmap →
- Available now
A kill switch per tool: every prompt and tool call refused until the fix is in. Roadmap →
- Not covered
Detecting that a plugin's code no longer matches its pinned commit.