Plugin4Shell: plugin SHA-pinning bypass gives zero-click RCE through background auto-update in Claude Code, Codex, GitHub Copilot and Gemini CLI

every installation of the four agents that installed any marketplace plugin whose upstream repository an attacker controls or compromises; Copilot and Gemini CLI installs remain exposed

Air Security (Or Nevo, Dor Granat, Niv Hoffman), published 2026-09-17; The Register 2026-09-17, Help Net Security 2026-09-18. Mechanism: for Claude Code, Codex and Copilot the install is git clone then git checkout <pinned-sha>; the attacker who controls the plugin's upstream repo creates a branch whose name is the exact 40-hex SHA and makes it the default, and git resolves the ref over the commit id. Gemini CLI variant: git fetch origin <ref> then git checkout FETCH_HEAD, defeated by a default branch literally named FETCH_HEAD. The changed pin triggers each agent's background auto-update, so the malicious plugin code runs with no prompt or click. Attacker need not control the marketplace, only the repository behind a plugin the marketplace already trusts. Discovered May 2026, disclosed to all four vendors June 2026. Air calls it the first supply-chain vulnerability of the AI agent ecosystem. No CVE mentioned on any cited page. The Register additionally states GitHub applied a partial mitigation via SHA restrictions while Microsoft Copilot remains unpatched. Distinct from AIR-2026-0002 (PromptArmor, injected marketplace plugins with hooks, Jan 2026), which concerned malicious plugin content rather than a pin-verification flaw. autonomy_level=assistant: the trigger is the agent's own auto-update routine, not a delegated task or model decision; ambiguity noted.