A pinned commit can resolve to different code
Air Security disclosed Plugin4Shell on 17 September, describing a supply-chain weakness in plugin installation for Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. The central failure is a missing post-checkout verification step: a client asks Git for a marketplace-pinned commit identifier, but does not then confirm that the working tree's resolved HEAD is that commit. Air says an attacker who controls or takes over the plugin repository can exploit Git ref ambiguity to make the checkout land on attacker-controlled code while the marketplace still presents the reviewed commit pin.
For Claude Code, Codex and Copilot, Air's demonstrated path uses a default branch whose name is the same 40-character hexadecimal string as the pinned commit. Git can prefer that ref name when resolving the checkout. The attack therefore has prerequisites: the attacker needs control of the plugin repository, the Git host must permit the ambiguous ref, and the affected client must install or update the plugin without verifying the resolved commit. Air says GitHub.com rejects 40-character hexadecimal branch names, while Bitbucket and self-hosted Git can permit them. Gemini CLI uses a different FETCH_HEAD ambiguity in the researcher's proof of concept.
OpenAI's public patch corroborates the Codex mechanism
OpenAI's public Codex repository independently confirms the core failure mode. Pull request 34644, merged on 22 July, says Git can interpret a requested commit SHA as a branch name when the remote default branch has the same name, causing a marketplace plugin source to materialise a different commit from the one it pinned. The fix resolves HEAD after checkout and rejects the plugin source unless the resolved commit exactly matches the requested SHA. Codex 0.146.0, released on 29 July, includes that change.
That public patch moves the Codex portion beyond a researcher-only report. Air says Anthropic fixed the same class of issue in Claude Code 2.1.179 after coordinated disclosure. Anthropic's public release record confirms that version was published on 16 June, but its release notes do not identify Plugin4Shell or describe a Git-pin security fix. The link between that version and this specific vulnerability therefore remains attributed to Air rather than independently documented by Anthropic.
Copilot and Gemini patch status is less settled publicly
Air says GitHub Copilot had not shipped a fix by the time of publication. GitHub's current documentation confirms that Copilot plugins can come from marketplaces, repositories and arbitrary Git URLs, including marketplaces hosted outside GitHub.com, but GitHub has not published a security advisory or release note that confirms or rejects Air's finding. The wire therefore treats Copilot's current vulnerability and patch state as reported by Air, not as a first-party-confirmed product status.
The Gemini CLI case has an additional inconsistency. Air says Google declined to patch this finding during Gemini CLI's transition to Antigravity. Google's own May transition announcement says consumer access was moving to Antigravity, but also says Gemini CLI would remain supported for enterprise and paid API users and would continue receiving bug and security fixes. Those public statements do not establish whether this particular checkout flaw was accepted, rejected or fixed, so a claim that every Gemini CLI installation will remain vulnerable would go beyond the first-party evidence available today.
The zero-click path depends on an already trusted plugin
Air describes the highest-impact path as zero-click because Claude Code and Codex can update already-installed plugins in the background. Under the researcher's scenario, a plugin is initially reviewed and pinned while benign; after the upstream repository is compromised or controlled by a malicious publisher, an automatic update resolves the ambiguous Git ref and replaces the working tree without a new installation decision. The resulting malicious plugin executes with the permissions available to the coding agent and its user.
No public evidence in the disclosure establishes exploitation in the wild, the number of successfully compromised machines, or that a marketplace itself was breached. The practical evidence is narrower: Air has published a cross-product proof of concept, and OpenAI's public code confirms and fixes the same commit-resolution defect in Codex. Updating Claude Code and Codex to the fixed versions identified by the disclosure is the clearest available mitigation; organisations using Copilot or Gemini CLI should seek vendor confirmation before assuming marketplace commit pins alone guarantee the code that actually ran.