AIDEFEND SecureFlow / SecureFlow Case Index

Plugin4Shell: Git Reference Shadowing Defeats Reviewed Plugin Pins

• Autonomous Agents
• System Compromise & RCE
• Data Exfiltration

Air Security demonstrated that AI coding clients could install different plugin code from the commit reviewed by a marketplace. An attacker controlling an already trusted plugin repository could shadow a pinned SHA with a default branch of the same name, or shadow FETCH_HEAD in Gemini CLI. Background updates then loaded malicious code without a fresh install decision. The defect is verification of the resolved working-tree commit, not a failure to review the marketplace entry; both repository control and a compatible client/hosting path are material prerequisites.