AIR Security’s Plugin4Shell disclosure found that AI agents checking out pinned commit SHAs never actually verify the result. Claude Code, Codex, Copilot, and Gemini CLI all run git checkout [SHA] and trust Git to deliver the right commit. But Git prioritizes branch names over commit objects: if an attacker creates a branch matching the 40-character SHA and makes it default, the branch runs instead. Straightforward exploit, catastrophic for agents that execute code at velocity.
The aftermath is more interesting than the bug itself. Anthropic patched in June. OpenAI in August. Microsoft remains unpatched; Google deprecated the product entirely rather than fixing it. Three months from disclosure, and the agents trusted with code execution operate on divergent security patches (or no patches at all). The exposure is supply chain risk: anything pinned to these dependencies inherits the patch status of vendors now operating on different timelines.
Git’s behavior here is sensible for human workflows. Agents betting on implicit verification is the miscalculation.
Sources: Plugin4Shell: Zero-Click RCE in AI Coding Agents
Coverage: Weekly Recap: Cisco 0-Day, AI Agent RCE, And The Week’s Trusted Attack Paths
Related on this blog: [AUTO] Claude Code auto-executes repository configuration • [AUTO] Malicious git configs execute code before approval • [AUTO] Attribution Gap in the RubyGems Supply-Chain Attack