Plugin4Shell: the AI coding agent pinned a hash, and the hash was not the last word

Friday's patch meeting is still Cisco. Identity Services Engine is a 10.0, the email gateway deadline already passed, and Saturday is a KEV cluster: ISE, the Acronis cPanel plugin, and the Pixel modem. Those are spoken for. The story that showed up today and will not make that list is about the coding agent on the laptop.

Air Security said a flaw they call Plugin4Shell lets the owner of a plugin repository swap the code an AI coding agent installs, even when the agent thought it had pinned a reviewed version. The Hacker News reported it on September 18. The four names in the write-up are Claude Code, OpenAI Codex, GitHub Copilot, and Google's Gemini CLI. Air says it built a working test in May and told the vendors in June. As of this morning there is no CVE, no vendor security advisory, and no public sign it has been used in a real attack. That last part is the only comforting sentence. The rest is a pin that was not a pin.

What "pinned" was supposed to mean

Developers lock a plugin to a hash or a tag so last month's review still matches what runs today. Air's finding is that control of the repository can still change what gets installed. We are not going to walk through the swap. The operational fact is enough: a reviewed SHA is not a guarantee if the agent resolves the plugin through a path the repo owner still controls.

Air's status board, as THN summarized it: Anthropic patched Claude Code in 2.1.179. OpenAI patched Codex in 0.146.0. GitHub Copilot has no fix in that account. Google is not patching the consumer Gemini CLI, which it is retiring in favor of Antigravity (Air says the same attack does not reach that one). Enterprise Gemini CLI still gets updates. Whether this fix is among them is unclear. Anthropic's 2.1.179 notes do not mention a security fix. If you only read release-note adjectives, you will miss it.

Why a shop in Alberta should care

These agents sit on machines that already have repo tokens, cloud keys, and the path to production. A plugin that turns into someone else's code is a supply-chain finding with a chat window. You do not need a nation-state. You need one popular plugin whose Git host changed hands, or a maintainer account that got phished.

Copilot is the awkward row. Air says it told Microsoft in June and that Copilot can install plugins from hosts other than GitHub. No patch means the control is policy: which plugin sources you allow, and whether a developer laptop is allowed to fetch community plugins at all.

The rest of Friday, in one paragraph

Fortinet is blocking thousands of hits on Orkes Conductor (CVE-2026-58138), a 9.8 in a workflow engine most security teams do not inventory. Kaspersky's MovieReaper swaps movie torrents for a Windows loader and looks up the next hop on Solana. The UK, US, and Dutch agencies described CHOSEN BRICK, Iranian Windows spyware aimed at dissidents and journalists. We wrote those three this morning. Tomorrow's federal clock is ISE, Acronis backup, and Pixel 2026-09-05. Civilian shops should treat that as a weekend list, not a US-only list.

What we would check before Monday

• Claude Code 2.1.179 or later. Codex 0.146.0 or later. Confirm the version on the machine, not the Slack announcement.
• If Copilot is in use, write down which plugin hosts are allowed. Until there is a patch, "community plugin from an unknown Git host" is a no.
• Gemini CLI: if you still have the consumer build, plan the move Google already asked for. Do not wait for a CVE that may never arrive.
• Inventory plugins the agents actually load. A pin in a markdown file is not evidence if the resolver can be talked into a different tree.
• ISE, Acronis plugin build, Pixel patch date. Those are Saturday's names whether or not you are a federal agency.

Bottom line

A coding agent with a dishonest pin is a software-supply problem that looks like a convenience feature. Forensic Five reviews what is actually reachable, including the tools developers installed because they were helpful. From St. Albert, Alberta. Update the agent. Then go finish Cisco.