Vulnerability
Four coding agents installed a plugin pinned to a SHA without checking the commit fetched.
A branch named like the hash is enough: Git can prefer the reference name over the commit object.
The attacker's plugin runs with the developer's rights, and the agent announces it respected the pin.
GitHub blocks branch names that look like hashes, but Bitbucket and self-hosted servers can remain exploitable.
Claude Code is fixed in 2.1.179 and Codex in 0.146.0, but GitHub Copilot has no fix.