Quirin Schlegel

Loading

The pin held, the checkout moved — a branch named like a commit reached four coding agents, and the duty that answers it is already in force

SHA pinning states an intention that nothing in the chain verifies, and the mitigation that actually shipped sits at the git host rather than in the agent.

21 September 202612 verified claims6 sources

A git branch can be named after a commit hash. Git will pick the branch. That is the whole attack, and it reached four coding agents.

On 17 September AIR Security published Plugin4Shell. Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI all install marketplace plugins by pinned commit SHA — the control most of us stopped thinking about years ago. None of the four checked that the checkout landed on the pin.

What this changes for anyone running agents in the EU:

1. The pin is not the control. An attacker who owns the plugin repo creates a branch whose name is the 40-hex pinned SHA. Git resolves a ref before an object, checks out the branch, and prints "refname is ambiguous" as a warning. Your lockfile still reads correct.

2. It is zero-click because of the update path, not the install. When a marketplace bumps its pinned SHA, the agent re-runs that checkout in the background. Nobody clicks anything.

3. Two of the four are fixed: Claude Code 2.1.179 and Codex 0.146.0. GitHub Copilot has shipped no patch. Google deprecated Gemini CLI rather than fix it. AIR found the bug in May and disclosed it in June.

4. The mitigation that actually shipped is at the forge. GitHub rejects a 40-hex branch name outright. Bitbucket and self-hosted git do not, and Anthropic's own documentation lists both as valid marketplace backends. Your git host is a security control now, and most teams picked it for other reasons.

5. In Germany this is not a vendor problem you get to wait out. § 30 BSIG names supply chain security, including the security aspects of your relationships with direct suppliers, among the measures you owe. § 38 makes the management body approve them, oversee them and carry the liability. NIS2UmsuCG has been in force since 6 December 2025, across roughly 29,500 entities. Nothing in it pauses because Microsoft has not patched.

My Monday: one line after every marketplace checkout — git rev-parse HEAD, compared against the pinned SHA, abort on mismatch. Then a second look at which host each marketplace actually lives on.

A pin is not a check. It is a statement of intent that nothing in the chain confirmed.

Which of your agents checked out something nobody verified?

#AgenticAI #NIS2 #DevSecOps #SupplyChainSecurity #EUTech

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

AIR Security published the Plugin4Shell research on 17 September 2026; the researchers are Or Nevo, Dor Granat and Niv Hoffman.
Why it mattersFixes the event date. Trade coverage ran on 17 and 18 September; the research post is the primary and dates itself 17 September.
airsecurity2026pluginshe · theregister2026ai
Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI all install marketplace plugins by pinned commit SHA, and none of the four verified that the checkout landed on the pinned commit.
Why it mattersThe pinned SHA is the control most teams rely on for plugin supply chain. It was not being enforced in any of the four.
airsecurity2026pluginshe · helpnetsecu2026zeroclick
Git resolves a name as a ref before treating it as an object id, so a branch named with the 40-hex pinned SHA is checked out instead of the pinned commit, with only a "refname is ambiguous" warning.
Why it mattersThis is standard documented git behaviour, not a git bug. Any tool that pins by SHA and checks out by name inherits it.
airsecurity2026pluginshe
The attack is zero-click because marketplaces bump their pinned SHA and agents re-run the checkout in the background without user action.
Why it mattersIt means the install-time review is not the exposure window; the update path is.
airsecurity2026pluginshe · helpnetsecu2026zeroclick
Claude Code is fixed in version 2.1.179 and OpenAI Codex in version 0.146.0.
Why it mattersThese are the version floors to require in a fleet check.
airsecurity2026pluginshe · helpnetsecu2026zeroclick
GitHub Copilot has shipped no fix, and Google deprecated Gemini CLI rather than patch it, directing users to Antigravity CLI.
Why it mattersTwo of the four remain exposed with no vendor remedy, which moves the control to the deployer.
helpnetsecu2026zeroclick · theregister2026ai
AIR Security discovered the vulnerability in May 2026 with a working proof of concept and disclosed it to all four vendors in June 2026.
Why it mattersThree months elapsed between disclosure and publication, and two vendors still shipped nothing.
airsecurity2026pluginshe · helpnetsecu2026zeroclick
GitHub rejects a 40-hex branch name outright, while Bitbucket and self-hosted git servers allow it, and Anthropic's documentation lists Bitbucket and self-hosted git as valid marketplace backends.
Why it mattersThe mitigation that shipped is at the git host, so the choice of forge decides whether a team has it.
airsecurity2026pluginshe · theregister2026ai
The researchers' recommended check is to compare the commit actually in the working tree against the pinned SHA and abort on mismatch, using git rev-parse HEAD.
Why it mattersOne line, and it is the only check that closes the gap independently of vendor or forge.
airsecurity2026pluginshe
Germany's NIS2 implementation act (NIS2UmsuCG), which amends the BSIG, entered into force on 6 December 2025 and covers approximately 29,500 entities.
Why it mattersThe duties described are in force now, not pending, and the scope is narrower than the exposure.
nisdirectiv2026germany · secjur2026nis · covingtonbu2026germany
Section 30 BSIG lists supply chain security, including security-related aspects of relationships with direct suppliers, among the risk-management measures an in-scope entity must implement.
Why it mattersIt makes the plugin marketplace and its git host a named part of the measures owed, not an optional hardening step.
covingtonbu2026germany
Section 38 BSIG obliges management bodies to implement and monitor those measures, requires them to participate regularly in training, and makes them liable for damages caused through fault.
Why it mattersThe duty has a named person attached, which is what distinguishes it from an internal security backlog item.
covingtonbu2026germany · secjur2026nis

Sources

AIR Securityprimary source
airsecurity2026pluginshe
Original Archived PDFretrieved 21 September 2026 · published 17 September 2026
Covington & Burlingsecondary
covingtonbu2026germany
Original Archived PDFretrieved 21 September 2026 · published 1 January 2026
Help Net Securitysecondary
helpnetsecu2026zeroclick
Original Archived PDFretrieved 21 September 2026 · published 18 September 2026
NIS 2 Directive transposition trackersecondary
nisdirectiv2026germany
Original Archived PDFretrieved 21 September 2026 · published 6 August 2026
secjursecondary
secjur2026nis
Original Archived PDFretrieved 21 September 2026 · published 1 January 2026
The Registersecondary
theregister2026ai
Original Archived PDFretrieved 21 September 2026 · published 17 September 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

None.