What happened
AIR Security researchers (Or Nevo, Dor Granat, Niv Hoffman) disclosed on Sept 17-18, 2026 that all four major AI coding agents share an identical flaw in how they validate SHA-pinned plugin/skill installations: the pin is checked at fetch time but never re-verified against the actual checked-out HEAD. This is the first identified supply-chain vulnerability targeting the AI agent distribution layer rather than the model or agent runtime itself.
Why it matters
Plugins inherit the full permissions of the developer running the agent — source code, cloud credentials, SSH keys, CI/CD secrets, and production access. Because the flaw defeats the exact safeguard (SHA pinning) that security-conscious organizations rely on, doing everything right (reviewing and pinning a plugin) provides no actual protection. The same design error was independently made by every major AI coding agent vendor, indicating a systemic blind spot in the AI-agent supply chain that mirrors classic software-supply-chain rug-pull attacks but at zero-click, cross-vendor scale.
Attack vector
All four agents check out a SHA-pinned plugin commit but never verify the resulting working tree actually matches that commit hash. Because git prioritizes a matching ref (branch) name over a commit object of the same name, a plugin repository owner can create a branch named after the pinned 40-hex commit hash and point it at malicious code; the agent's checkout resolves to the malicious branch while still reporting the expected SHA as installed. On agents with background auto-update (default for Claude Code/Codex marketplaces), this requires no user interaction — the malicious code silently replaces the trusted plugin on the next update cycle.
Affected systems
Claude Code (< 2.1.179), OpenAI Codex (< 0.146.0), GitHub Copilot (unpatched), Google Gemini CLI (will not be patched — deprecated)
Mitigation
Update Claude Code to 2.1.179+ and Codex to 0.146.0+ immediately. No fix yet for GitHub Copilot; Google will not patch Gemini CLI (migrate to Antigravity). Prefer GitHub-hosted marketplaces (GitHub rejects hash-shaped branch names, blunting the classic variant); avoid Bitbucket/self-hosted plugin sources where the bypass remains fully exploitable.