Flaw lets repository owners swap pinned plugin code across four AI coding agents

Air Security reported that four AI coding agents fetch plugins pinned to a reviewed commit hash but never verify the code they receive matches it. On code hosts that permit branch names shaped like commit hashes, such as Bitbucket or self-hosted git, a plugin repository owner can point that name at different code, so the agent installs malicious code while reporting the locked version. Because plugins run with the user's access, the swapped code reaches files, credentials, and connected systems. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; GitHub Copilot has no fix, and Google will not patch the retiring Gemini CLI.

Check

Update Claude Code and Codex to the fixed releases, then inventory installed agent plugins sourced from Bitbucket or self-hosted git rather than GitHub.

Affected

Agents installing plugins from hosts that allow commit-hash-shaped branch names can run attacker-swapped code under the user's own access despite version pinning.

Fix

Upgrade to patched agents, restrict plugins to GitHub-hosted repositories that block such branch names, and review Copilot and Gemini CLI plugin usage.