Plugin4Shell: SHA-pinning bypass gives zero-click RCE in AI coding agents

Pinning a plugin to a commit SHA feels like the safe choice, right up until you learn the agent never checked that git handed back that commit. Name a branch after the 40-character hash, make it the default, and git happily resolves to the branch. That is zero-click RCE on the next background auto-update. Claude Code fixed it in 2.1.179 and Codex in 0.146.0; Copilot is still unpatched and the deprecated Gemini CLI won’t be.