Coding-agent plugins could bypass a pinned version

What happened

Air Security demonstrated ways to install attacker-selected plugin code despite a configuration pinning a reviewed commit. The attacker needs control of a trusted plugin repository. A crafted repository reference can cause installation or updating to resolve different code.

Claude Code 2.1.179 and Codex 0.146.0 contain fixes. At publication, the researcher said Copilot remained unpatched and Gemini CLI would not receive a fix. One variant requires a repository host that accepts SHA-shaped branch names; GitHub rejects those names. The Gemini variant uses a different reference ambiguity.