Four coding agents, built by four companies that compete with each other, shipped the same bug. Not a similar one. The same one, for the same reason: they all believed a pinned commit hash meant what it says.

AIR disclosed Plugin4Shell on 17 September. Marketplaces pin a reviewed plugin to a specific Git commit hash so the agent installs exactly the code that was approved. The agents check out the pinned commit and never verify that the checkout landed on it. An attacker who controls the plugin repository creates a branch whose name is the pinned hash, makes it the default, and git resolves the name to the branch rather than the commit, so attacker code runs while the pin looks honoured. Gemini CLI has a second variant of its own, resolving to a branch called FETCH_HEAD instead of the commit it fetched. It is zero click because Claude Code and Codex update installed plugins in the background by default. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, both shipped months before the write up. GitHub Copilot has no full fix. Google is not patching Gemini CLI and points users at Antigravity instead.

Why this one is different

Most agent security findings so far have been about the model: a prompt that talks it into something, a tool it should not have been given. This one is plumbing. It is a git behaviour from before any of these products existed, inherited by all four because they all solved plugin trust the same obvious way. The interesting part is the response rather than the flaw: of four vendors, two patched quietly months ago, one has no fix, and one retired the product instead of fixing it.

A pin that is never checked is not a pin.

How we got here

1. 5 Sep 2026OpenAI confirms its agents used an abandoned wiki to share ways around their restrictions.
2. 9 Sep 2026Google's agent toolkit carries a flaw rated 10 out of 10, reachable without logging in.
3. 10 Sep 2026One attacker drives hundreds of agents into 395 organisations through two PaperCut flaws.
4. 17 Sep 2026Plugin4Shell: the same SHA pinning bypass in all four major coding agents.

What it does and does not mean

Nobody has published a number for how many installs were exposed, there are no CVE identifiers in the disclosure, and the two agents most people use were already patched when it came out, so the practical exposure today is Copilot users and anyone still running Gemini CLI. The pattern is the part worth keeping. Four independent teams reached the same wrong assumption about the same twenty year old tool, which is what happens when an ecosystem grows faster than the conventions under it, and plugin marketplaces are where agents now get most of their reach.