A pinned plugin commit was a request, not a check, in four agents
AIR Security (2026-09-17): Claude Code, Codex, Copilot and Gemini CLI installed plugins pinned to a commit SHA without verifying the checkout landed on it; git prefers a branch named like the SHA, and Gemini CLI checks out FETCH_HEAD. Claude Code's fix (2.1.179) has no changelog line; Codex's is PR 34644 in 0.146.0. Gemini CLI 0.60.0 still calls git.checkout('FETCH_HEAD'), and Google told AIR the tool is deprecated and will not be patched. No Copilot changelog line through 1.0.87 names a fix.
What this changes for operators
- On Copilot CLI and Gemini CLI, treat a pinned plugin or extension as unverified: source it from a host that rejects 40-hex branch names or a repo you control, and check the installed tree’s HEAD after install.
- The attacker must control the plugin repository. Background auto-update is what makes it zero-click; turn it off where you cannot verify sources.
- Evidence that would settle residual: a Copilot CLI release note or advisory naming the fix.
Primary sources
- tagged_commit_file 2026-09-21-gemini-cli-extension-install-still-checks-out-fetch-head-after-plugin4shell-disclosure google-gemini/gemini-cli / packages/cli/src/config/extensions/github.ts
- third_party_research 2026-09-21-claude-code-plugin4shell-disclosed-in-window-fix-shipped-in-2-1-179-with-a-silent-changelog www.air.security/blog-posts/plugin4shell
- tagged_commit_file 2026-09-21-github-copilot-cli-plugin4shell-no-changelog-line-names-a-fix-through-1-0-87 github/copilot-cli / changelog.md#L567
- tagged_commit_file 2026-09-21-claude-code-plugin4shell-disclosed-in-window-fix-shipped-in-2-1-179-with-a-silent-changelog anthropics/claude-code / CHANGELOG.md
Signal metadata
Source findings
- 2026-09-21-gemini-cli-extension-install-still-checks-out-fetch-head-after-plugin4shell-disclosure 2026-09-21-gemini-cli-extension-install-still-checks-out-fetch-head-after-plugin4shell-disclosure
- 2026-09-21-github-copilot-cli-plugin4shell-no-changelog-line-names-a-fix-through-1-0-87 2026-09-21-github-copilot-cli-plugin4shell-no-changelog-line-names-a-fix-through-1-0-87
- 2026-09-21-claude-code-plugin4shell-disclosed-in-window-fix-shipped-in-2-1-179-with-a-silent-changelog 2026-09-21-claude-code-plugin4shell-disclosed-in-window-fix-shipped-in-2-1-179-with-a-silent-changelog
Featured in
- Before the First Turn / 2026-09-21
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Schema: bitter.frontier_signals.v0 / ID: 2026-09-21-plugin4shell-a-pin-is-a-request
Research evidence and publication history are open in the repository.