Four AI coding agents pinned the commit. None checked what arrived.

Last week three researchers published a flaw that sat in four AI coding agents at the same time: Claude Code, Codex, GitHub Copilot and Gemini CLI. They called it Plugin4Shell. The mechanism fits in a paragraph, and it is the kind of bug that makes careful engineers wince, because every step of it was done by the book.

Coding agents install plugins from Git repositories and pin each one to a commit hash. Forty characters that say: this code, and only this code. That is the right instinct. It is how you stop a dependency changing under you.

Git has a quirk. When a name is both a valid branch and a commit id, checkout prefers the branch. So if whoever controls the plugin's repository creates a branch named exactly like the pinned hash and points it at different code, the agent asks for the commit and gets the branch. It reports success, because it never looked at what landed in the working tree.

Then the part that makes it zero-click. The same checkout re-runs in the background on auto-update, the default in two of the four tools. Bump the pin in the marketplace and the swapped code reaches every installed machine with nobody pressing anything.

The fix the researchers recommend is one line. After checkout, read the commit that is actually in the tree and abort unless it equals the pin. Verify what arrived, not what you asked for.

Two vendors had shipped that line before disclosure. One had not. One retired the product instead.

I keep this one next to sheet 002, where an agent handed over its own API key. Different tool, same shape: the check that would have caught it was cheap, and nobody thought it was needed, because the request had already been checked.

Sheet 005.