{"id":747686,"date":"2026-09-21T16:05:21","date_gmt":"2026-09-21T13:05:21","guid":{"rendered":"https:\/\/buradabiliyorum.com\/en\/a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents\/"},"modified":"2026-09-21T16:05:21","modified_gmt":"2026-09-21T13:05:21","slug":"a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents\/","title":{"rendered":"A single git trick beat the safety lock on four AI coding agents"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af1c7bfd5057\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af1c7bfd5057\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents\/#What_Plugin4Shell_actually_does\" >What Plugin4Shell actually does<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents\/#Why_nobody_has_to_click\" >Why nobody has to click<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents\/#GitHub_says_its_users_are_not_exposed\" >GitHub says its users are not exposed<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents\/#How_much_of_this_reaches_real_developers\" >How much of this reaches real developers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents\/#Four_months_no_CVE\" >Four months, no CVE<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/a-single-git-trick-beat-the-safety-lock-on-four-ai-coding-agents\/#The_third_time_this_has_happened\" >The third time this has happened<\/a><\/li><\/ul><\/nav><\/div>\n<p><img decoding=\"async\" src=\"https:\/\/media.thenextweb.com\/2026\/09\/backlit-keyboard-two-monitors-source-code-dark-room.avif\" \/><\/p>\n<div id=\"article-main-content\">\n<p>The AI industry already knew attackers could poison plugin marketplaces. Its answer was to lock every plugin to one reviewed version of its code. That lock is what just broke.<\/p>\n<p>Researchers at Air Security published a vulnerability on Thursday that they call <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.air.security\/blog-posts\/plugin4shell\" target=\"_blank\" rel=\"nofollow noopener\">Plugin4Shell<\/a>. It affects the four most widely used AI coding agents. Those are Anthropic\u2019s Claude Code, OpenAI\u2019s Codex, GitHub Copilot and Google\u2019s Gemini CLI. Or Nevo, Dor Granat and Niv Hoffman call it zero-click remote code execution. The attacker needs no action at all from the victim. Jessica Lyons <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.theregister.com\/security\/2026\/09\/17\/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom\/5297335\" target=\"_blank\" rel=\"nofollow noopener\">first reported it for The Register<\/a>.<\/p>\n<p>Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Microsoft has shipped no fix for Copilot. Google will not fix the Gemini CLI, because it is retiring it.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_Plugin4Shell_actually_does\"><\/span>What Plugin4Shell actually does<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Coding agents install add-ons from marketplaces. To keep those add-ons safe, a marketplace pins each one to a commit hash. That is a 40-character string identifying one exact snapshot of the code. Review the snapshot once, pin it, and the agent should run that same audited code forever.<\/p>\n<p>Air found that the agents ask for the pinned snapshot but never check what they got. Git lets a branch carry almost any name, including a string that looks exactly like a commit hash. When a name is both a valid branch and a valid object, git quietly prefers the branch.<\/p>\n<p>So whoever controls a plugin\u2019s repository can create a branch named after the pinned hash. They point it at different code and make it the default. The agent checks out the branch, installs the attacker\u2019s code, and reports a clean install at the pinned commit.<\/p>\n<p>The Gemini CLI breaks a different way. It fetches the right commit, then runs a checkout that a default branch named FETCH_HEAD can capture. The correct code never reaches the disk.<\/p>\n<p>The fix is one line. After checking out, resolve what actually sits in the working tree, then abort unless it matches the pin.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Why_nobody_has_to_click\"><\/span>Why nobody has to click<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Agents refresh installed plugins in the background. Claude Code and Codex do this by default. So the attack does not need anyone to install anything new. It replaces a plugin the developer already trusts and already runs.<\/p>\n<p>Air lays out the sequence. Publish something genuinely useful. Pass review, gather users. Ship a routine update so the marketplace re-pins to a new commit. Then create a branch named after that new pin and fill it with malicious code. Every agent\u2019s auto-update does the rest.<\/p>\n<p>A plugin runs with the same access as the person using the agent. The sw<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ed code therefore reaches their files, their stored credentials and every system they can log in to. OWASP flagged that same problem this month, moving excessive agency to third place in its 2026 top ten.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"GitHub_says_its_users_are_not_exposed\"><\/span>GitHub says its users are not exposed<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>GitHub rejects branch names shaped like commit hashes, so the branch trick fails there. A spokesperson told The Register that this mitigation stops anyone exploiting the vulnerability on GitHub.<\/p>\n<p>Air disagrees. Marketplaces can sit elsewhere, including on Bitbucket and on a company\u2019s own git server. Both of those allow hash-shaped branch names, and Anthropic\u2019s own documentation lists them as valid marketplace backends. Copilot supports those hosts too, which is where Air says the risk sits. Microsoft did not respond to The Register.<\/p>\n<p>This is not the first time GitHub has contested a researcher\u2019s finding about Copilot. It is worth noting that roughly 90% of Fortune 500 companies use Copilot, on Microsoft\u2019s own figure, and Copilot is one of the two agents with no patch.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_much_of_this_reaches_real_developers\"><\/span>How much of this reaches real developers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Plugin4Shell is narrower in practice than the headline count of four agents suggests, and the most useful reporting on that came from The Hacker <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a>. Swati Khandelwal <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/thehackernews.com\/2026\/09\/plugin4shell-lets-repository-owners.html\" target=\"_blank\" rel=\"nofollow noopener\">checked the marketplaces<\/a> the agents ship with on 18 September and found that every plugin in Anthropic\u2019s community catalogue, and in the default catalogues for Claude Code and Copilot, points to a GitHub repository.<\/p>\n<p>The two halves of the attack also pull apart. Background auto-update is the part that makes it zero-click. It runs by default only for the agents\u2019 own built-in marketplaces, and those live on GitHub. For outside marketplaces it stays off or optional. A developer who installs only from the default catalogues never meets the branch-name version.<\/p>\n<p>That reasoning does not cover the Gemini CLI. Its variant relies on a branch named FETCH_HEAD rather than a hash, and GitHub\u2019s rule does not clearly block that name. It is also the one agent nobody will ever patch.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Four_months_no_CVE\"><\/span>Four months, no CVE<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Air built a working proof of concept in May and disclosed to all four vendors in June. Anthropic confirmed its fix on 17 June. Google said on 4 August that none would ship. Codex was verified fixed on 12 August.<\/p>\n<p>As of 18 September, The Hacker News found no CVE identifier assigned and no security advisory published by any of the four vendors. Anthropic\u2019s release notes for 2.1.179 do not mention the fix at all, so Air\u2019s post is the only public account that it exists. There is no sign the flaw has been used in a real attack.<\/p>\n<p>Four months of silence is a long time for a flaw in software the Fortune 500 runs. It also sits awkwardly beside where European rules are heading. The Cyber Resilience Act sets a 24-hour reporting deadline for actively exploited vulnerabilities and pushes hard towards documented software supply chains.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_third_time_this_has_happened\"><\/span>The third time this has happened<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Air has been working this seam for months. It planted a malicious skill in a marketplace and reached about 26,000 agents. It then hijacked 925 skills already in use, affecting 134,000 agents, by taking over the repositories behind them.<\/p>\n<p>SHA pinning was the industry\u2019s answer to both. Five labs agreed a common plugin standard in August. Attackers now go after the distribution layer underneath the models rather than the models themselves. The same design error appeared in four products from four different companies, which suggests nobody checked the assumption rather than that one team slipped.<\/p>\n<p>One thing the published accounts do not settle: whether updating an affected agent removes a plugin that was already swapped, or only stops the next swap. Developers who have seen Claude Code hijacked before, or watched OpenAI agents turn up inside RubyGems, will recognise the pattern.<\/p>\n<p>The Gemini CLI stays vulnerable permanently. Google points users at Antigravity instead, which the attack cannot reach because it has no plugin pinning to bypass. The question worth revisiting in a year: how many Gemini CLI installs are still running.<\/p>\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMN63nwsw68G3Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/buradabiliyorum.com\/en\/category\/technology\/\" target=\"_blank\" >Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/thenextweb.com\/news\/plugin4shell-ai-coding-agents-zero-click-rce-sha-pinning\" target=\"_blank\" >Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The AI industry already knew attackers could poison plugin marketplaces. Its answer was to lock every plugin to one reviewed version of its code. That lock is what just broke. Researchers at Air Security published a vulnerability on Thursday that they call Plugin4Shell. It affects the four most widely used AI coding agents. Those are&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-747686","post","type-post","status-publish","format-standard","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/747686","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=747686"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/747686\/revisions"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=747686"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=747686"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=747686"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}