The pin held, the checkout moved — a branch named like a commit reached four coding agents, and the duty that answers it is already in force

SHA pinning states an intention that nothing in the chain verifies, and the mitigation that actually shipped sits at the git host rather than in the agent.

Post

A git branch can be named after a commit hash. Git will pick the branch. That is the whole attack, and it reached four coding agents.

On 17 September AIR Security published Plugin4Shell. Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI all install marketplace plugins by pinned commit SHA — the control most of us stopped thinking about years ago. None of the four checked that the checkout landed on the pin.

What this changes for anyone running agents in the EU:

  1. The pin is not the control. An attacker who owns the plugin repo creates a branch whose name is the 40-hex pinned SHA. Git resolves a ref before an object, checks out the branch, and prints "refname is ambiguous" as a warning. Your lockfile still reads correct.

  2. It is zero-click because of the update path, not the install. When a marketplace bumps its pinned SHA, the agent re-runs that checkout in the background. Nobody clicks anything.

  3. Two of the four are fixed: Claude Code 2.1.179 and Codex 0.146.0. GitHub Copilot has shipped no patch. Google deprecated Gemini CLI rather than fix it. AIR found the bug in May and disclosed it in June.

  4. The mitigation that actually shipped is at the forge. GitHub rejects a 40-hex branch name outright. Bitbucket and self-hosted git do not, and Anthropic's own documentation lists both as valid marketplace backends. Your git host is a security control now, and most teams picked it for other reasons.

  5. In Germany this is not a vendor problem you get to wait out. § 30 BSIG names supply chain security, including the security aspects of your relationships with direct suppliers, among the measures you owe. § 38 makes the management body approve them, oversee them and carry the liability. NIS2UmsuCG has been in force since 6 December 2025, across roughly 29,500 entities. Nothing in it pauses because Microsoft has not patched.

My Monday: one line after every marketplace checkout — git rev-parse HEAD, compared against the pinned SHA, abort on mismatch. Then a second look at which host each marketplace actually lives on.

A pin is not a check. It is a statement of intent that nothing in the chain confirmed.

Which of your agents checked out something nobody verified?

#AgenticAI #NIS2 #DevSecOps #SupplyChainSecurity #EUTech

First comment

Sources, in the order I used them.

The Plugin4Shell research itself — Or Nevo, Dor Granat and Niv Hoffman at AIR Security, published 17 September 2026, with the git behaviour and the rev-parse check written out: https://www.air.security/blog-posts/plugin4shell

Help Net Security on the patch status, and which two agents are still exposed: https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/

The Register's write-up, including GitHub's own restriction on SHA-shaped branch names: https://www.theregister.com/security/2026/09/17/ai_coding_agents_0-click_rce_flaw_could_hand_attackers_keys_to_the_kingdom/

Covington on the German NIS2 transposition — the § 30 risk-management measures and the § 38 duties on the management body: https://www.globalpolicywatch.com/2026/01/germany-transposes-nis-2-directive-increased-cybersecurity-requirements-for-businesses/

The transposition tracker for Germany, for the entry-into-force date: https://www.nis-2-directive.com/Transposition/Germany.html

One point I cut for length: most of you are not in scope. NIS2 bites essential and important entities in listed sectors above the size cap — roughly 29,500 companies in Germany, not the five-person studio in Neukölln. The exposure does not care about the size cap, and neither does the fix. The law is the floor here, not the reason.

Claims

Sources

Corrections

None.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.