AIR says Claude Code, Codex, GitHub Copilot and Gemini CLI all check out a pinned plugin commit without verifying they landed on it, so a trusted plugin can be swapped for attacker code during a background auto-update. Anthropic and OpenAI have patched.
Perspective Coverage
4 publishers
- Builder
- Builder 41%
- Operator
- Operator 50%
- Investor
- Investor 9%
Reality
- Evidence70
- Adoption35
- Hype gap+40
- Incentives75
- Confidence66
buildOne report1 publisher A branch named like a commit SHA swapped plugin code in Claude Code, Codex and Copilot
Air Security found four coding agents skipped checking plugin code against its pinned commit SHA, a gap one test plugin used to reach 26,000 agents. Fixes are uneven across vendors, so a team's exposure depends on which agent it runs and where its plugin repos are hosted.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+40
- Incentives
- Not scored
- Confidence35
Sequoia and Greenoaks led the round for a 40-person company founded in February, which makes the priced asset a research library showing 6.7 million installs of add-ons that fetch their instructions from sources nobody vetted.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+30
- Incentives70
- Confidence60
A fake branch name defeats the commit pin four AI coding agents rely on
Air Security's Plugin4Shell lets a plugin be swapped during a background refresh while the agent reports the audited commit. Anthropic and OpenAI have patched, Copilot has no fix, and Google is retiring Gemini CLI.
Reality
- Evidence60
- Adoption65
- Hype gap+20
- Incentives70
- Confidence58
The attacker needed no zero-day, only frontier AI agents that cut a two-week intrusion down to a single shift, and the control that stopped their Terraform backdoor was a branch-protection gate rather than an alert.
Reality
- Evidence56
- Adoption52
- Hype gap+32
- Incentives80
- Confidence58
AIR Security counts 17,800 AI add-ons taking instructions from outside their packages
The census behind a Sequoia-led round describes 6.7 million installations of add-ons that fetch their instructions at runtime, some of them Skills impersonating Anthropic and OpenAI to clear a security review.
Reality
- Evidence28
- Adoption18
- Hype gap+45
- Incentives85
- Confidence35
AIR Security raises $50M to screen the unverified plugins AI agents pull in at runtime
The company's researchers count 17,800 public add-ons pulling unverified instructions, a number produced by the same firm selling the fix, which still leaves operators with an inventory problem they own either way.
Reality
- Evidence28
- Adoption22
- Hype gap+42
- Incentives88
- Confidence38
buildOne report1 publisher AIR Security raised $50M to inspect the skills an agent loads before it loads them
The founders' claim is that permissions describe an agent's reach while its context decides its behaviour, and their own scan of 142,836 public skills flagged roughly one in eight as leaning on an external resource they could not vouch for.
Reality
- Evidence45
- Adoption22
- Hype gap+30
- Incentives80
- Confidence55
Air Security hijacked live Official MCP Registry entries by buying their expired domains
The MCP layer inherits its trust at install time and never re-checks it, so a lapsed domain behind a still-listed registry entry belongs to whoever registers it next. Air Security says it registered one, and agents came.
Publishers:air.security
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+32
- Incentives84
- Confidence34