Overview
- Researchers at Air Security disclosed a zero-click supply-chain bug that lets a repo owner or attacker swap supposedly pinned plugin code and run arbitrary commands with the agent user's access.
- The root cause is git checkout behavior: agents fetch a pinned commit but do not verify the working-tree commit hash, so a branch name or FETCH_HEAD trick can make the checkout land on different code than the pinned SHA.
- Public reporting on Sept. 18–19 confirmed Anthropic shipped Claude Code 2.1.179 and OpenAI shipped Codex 0.146.0 to address the gap, Microsoft has not released a Copilot fix, and Google deprecated Gemini CLI leaving existing installs exposed.
- Because many agents auto-update plugins in the background by default, a malicious swap can reach already-installed agents without any user action; users should update patched agents, disable auto-update where possible, and audit checked-out plugin trees.
- Fixing the problem requires agent-side changes such as an explicit post-checkout verification like comparing git rev-parse HEAD to the pinned SHA, and wider supply-chain controls are needed to limit repo-takeover and SkillJacking risks.