ZOVERIONS

AGENT SECURITY / PRACTICAL CHECK / 2026-09-19

Pinned is not
proven.

A plugin can be approved, pinned to an exact commit identifier, and still materialize different code if the client never verifies what actually landed in the working tree.

THE CURRENT FAILURE MODE

Identity claims are not execution evidence.

On September 17, 2026, AIR Security disclosed Plugin4Shell, a supply-chain flaw affecting plugin installation in major AI coding agents. The core mistake was narrow but consequential: clients requested a pinned commit and performed the checkout, but did not independently verify that the resolved working tree actually matched that commit.

AIR reports fixes in Claude Code 2.1.179 and Codex 0.146.0. Its disclosure said GitHub Copilot had not shipped a fix and the deprecated Gemini CLI would not receive one at publication time. Check the current vendor release before relying on those status details.

Read the primary disclosure

THE BOUNDARY

Resolve. Verify. Then authorize.

The useful invariant is broader than one Git bug:

requested identity → resolved object → content evidence → policy decision → authority → execution

Do not collapse those steps. A tag, SHA string, marketplace approval, manifest, discovery response, model claim or client-supplied capability can contribute evidence. None of them should silently become permission to execute whatever bytes happen to arrive.

ONE-COMMAND AXIOM CHECK

Try to break the adjacent trust boundary.

AXIOM-MESH does not claim to reproduce or patch Plugin4Shell. This is a separate, source-level falsification exercise for the same architectural principle: metadata and claimed capability must not silently become authority.

git clone https://github.com/Zoverions/AXIOM-MESH.git && \
cd AXIOM-MESH && \
git checkout --detach a978c90a11b63e0e8b8441876378a26304aea46a && \
node --test mesh/test/agent-commons-mcp-readonly.test.mjs mesh/test/plural-capability-lease.test.mjs

A passing run is only the baseline. The useful contribution is a reproducible counterexample: metadata changes an accepted mapping, evidence is reusable against a different scope, stale or duplicate approval is accepted, or an inert/read-only path reaches consequential authority.

Open the full trust drill Inspect AXIOM-MESH

REPORT A COUNTEREXAMPLE

Evidence beats a security slogan.

Include the exact commit SHA, command or request frame, expected boundary, observed result, reproducibility, and only the minimum safe evidence needed. Do not include credentials, private data, production tokens or secrets.

Open an AXIOM-MESH issue

Scope note: this page is a technical acquisition experiment and security explainer, not a claim that AXIOM-MESH is production-promoted or compatible with the affected plugin systems.