Indexed — Monday, September 28, 2026

SHA pinning was supposed to freeze a reviewed plugin forever. AIR Security showed four major coding agents ask Git for that pin and then never check that the checkout actually landed there. If you run Claude Code or Codex, this is a version check — not a vibes check.

The Signal

AIR Security published Plugin4Shell around September 17–18: a plugin SHA-pinning bypass that hits Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google’s Gemini CLI (AIR, The Hacker News, Help Net Security).

How it works in plain English: marketplaces pin a plugin to a commit hash. The agent checks that pin out through Git. Git can treat a branch named like that hash as the thing you asked for. Whoever controls the plugin repo can point that branch at different code. The agent still reports the locked version. On Claude Code and Codex, background plugin auto-update is on by default — so a plugin you already trust can flip without a fresh install click.

What to do this week:

• Claude Code: update to 2.1.179 or later (claude --version).
• Codex: update to 0.146.0 or later (codex --version).
• GitHub Copilot: no agent patch as of the reports. Prefer plugins whose repos live on GitHub (GitHub rejects hash-shaped branch names). Drop Bitbucket / self-hosted marketplace backends until Microsoft ships a fix.
• Gemini CLI: Google is not patching; migrate off it (AIR and Google point people at Antigravity).

Honesty check: The Hacker News found default Claude/Copilot catalog plugins pointing at GitHub repos, which blocks the main branch-name trick. You are still exposed if you added non-GitHub marketplaces, if you stay on Copilot without a fix, or if you still run Gemini CLI. Pinning was the safety story. The agents had to fix the check themselves — no marketplace can paper over a bad checkout.

No public CVE ID yet. No confirmed in-the-wild campaign in the coverage we saw. Still treat the version gate as real.

The Stack

Fifteen minutes. Do it before the next long agent run.

1. Patch Claude Code and Codex to the floors above. Re-check versions after update.
2. List every plugin marketplace you added. Keep GitHub-hosted defaults. Remove Bitbucket / self-hosted / “company git” marketplace entries until you know the host rejects hash-shaped refs.
3. On Copilot: same marketplace audit; there is no agent patch to lean on.
4. If you still use Gemini CLI for consumer agent work, plan the move off it. Do not wait for a Plugin4Shell patch that is not coming.

One decision today: write down which agents you actually run daily, and which of those are below the patched floors. That list is the whole job.

Prompt of the Day

Paste this into the agent you trust most *after* you update it:

You are my coding-agent plugin auditor. I will paste: (1) claude --version and/or codex --version output, (2) my list of installed plugins and marketplace URLs/hosts, (3) whether plugin auto-update is on. Compare versions to floors Claude Code 2.1.179 and Codex 0.146.0. Flag any marketplace host that is not github.com. Tell me: update now / marketplace remove / leave alone. End with a three-line checklist I can run in the terminal today. Ask for missing version strings before you invent them.

Run it with real --version output. If the model guesses a version, throw the answer out.

Operators inside AI Freedom Lab are comparing which agents they actually keep hot after Plugin4Shell — faster than waiting for another vendor blog.

Tool of the Day

Claude — Anthropic’s assistant / Claude Code stack. Featured in the AI Tools Index.

Why it earns the slot this week: Claude Code is one of the two agents with a shipped Plugin4Shell fix (2.1.179+). If Claude Code is in your daily loop, the Tool of the Day action is boring on purpose: update, re-check claude --version, then re-list plugins.

Do this one thing: update Claude Code past 2.1.179, then run the audit prompt above on your real plugin list.

Quick Hits

Google opened early access to a Google Home MCP server so MCP-capable agents can control Nest / Matter devices — U.S. Home Premium Advanced ($20/mo) for now (TechCrunch). Fun for home labs; not your coding-agent patch queue.

OpenAI published more misalignment / “concerning behavior” disclosures (including agent-ish jailbreak chatter). Useful context, weak Monday lead for builders who need a version number.

Copilot still has no Plugin4Shell agent patch in the AIR / THN reporting. Treat “we only use the official marketplace” as incomplete if any plugin source is off GitHub.

Gemini CLI consumers: assume permanent exposure on this bug class; plan the migration instead of waiting.

Closing the loop

Pinning only works if the agent verifies the checkout. Two vendors shipped that check. Two did not. Update Claude Code and Codex today, audit marketplace hosts, and do not pretend Copilot or Gemini CLI are covered by someone else’s patch notes.

Footer CTAs

Join AI Freedom Lab — builders shipping with AI: https://www.skool.com/aifreedomlab

Today's Tool of the Day: Claude on the AI Tools Index: https://aitoolind.io/tools/claude

Missed an issue? Browse the Indexed archive: https://indexednewsletter.com/archive