GovKM
Provenance at Use Time in AI Plugin Supply Chains

The Hash Was Right. The Code Was Wrong.

Plugin4Shell showed that a valid pinned commit record can coexist with execution of different code. Provenance must be revalidated at the moment of use.
Published:
September 23, 2026
|
5
min read
|
Governance Architecture
|
Series:
GovKM Research
Governance illustration representing a plugin marketplace with a valid pinned commit record while the coding agent executes different attacker-controlled code.
Expand image

A record of provenance is not provenance if the runtime no longer points to the recorded object.

AIR Security disclosed Plugin4Shell, a SHA-pinning bypass affecting several major AI coding agents. A marketplace could review and record a known-good plugin commit while the agent later resolved and executed different attacker-controlled code. Vendors issued fixes for affected products, with patch status varying by product at disclosure.

The continuity failure

The institution preserved the approved commit record while losing continuity between that record and the code actually executed.

The GovKM interpretation

Provenance must be revalidated at use time. Identifiers, hashes, repository paths, and approval records are only evidence if they continue to resolve to the same artifact.

Continuity path: Source/reviewed plugin → Evidence/pinned commit → Authority/marketplace approval → Context/agent install → Action/executed code → Record.

Source

AIR Security, “Plugin4Shell — Zero Click RCE Vulnerability Found in Top 4 Most Popular Coding Agents,” September 17, 2026.

RELATED FRAMEWORK DOMAINS

Explore the Connected Framework

Continue through the framework domains connected to this article.

FRAMEWORK DOMAIN

Information Continuity

Keep information trustworthy, accessible, and connected regardless of the technology used to create or manage it.

FRAMEWORK DOMAIN

Records Governance

Govern records as authoritative evidence supporting accountability, compliance, and organizational continuity.

RELATED CORE PRINCIPLES

Principles Applied in This Article

Explore the core principles connected to this article.

CORE PRINCIPLE

Grounded Trust

Maintain authority, evidence, provenance, and governance so organizational knowledge remains reliable and explainable.

CORE PRINCIPLE

Contextual Understanding

Preserve the relationships and context that allow organizational knowledge to retain meaning across time and change.

CORE PRINCIPLE

Relationship Governance

Connect and govern information, authority, evidence, context, decisions, actions, records, and institutional memory as one continuity architecture.

RELATED TOPOLOGY ELEMENTS

Follow the Continuity Relationships

Explore the continuity topology elements connected to this article.

CONTINUITY TOPOLOGY

Source

The originating person, system, record, event, or environment from which information enters institutional use.

CONTINUITY TOPOLOGY

Evidence

The verifiable material that supports, qualifies, challenges, or constrains an institutional claim.

CONTINUITY TOPOLOGY

Authority

The institutional standing that determines whether information, interpretation, or action is recognized as valid or permitted.

CONTINUITY TOPOLOGY

Context

The circumstances, relationships, constraints, and meaning required to interpret information correctly for a specific institutional purpose.

CONTINUITY TOPOLOGY

Decision

The governed selection, judgment, or determination made from available evidence, authority, and context.

CONTINUITY TOPOLOGY

Action

The execution, intervention, communication, or operational change performed in response to a decision or authorized objective.

CONTINUITY TOPOLOGY

Record

The durable institutional evidence of information, decisions, actions, transactions, and their governing relationships.

CONTINUITY TOPOLOGY

Institutional Memory

The governed body of retained knowledge and relationships through which an institution can understand and reconstruct its prior experience.

CONTINUITY TOPOLOGY

Future Reuse

The responsible application of preserved institutional knowledge to future analysis, decisions, actions, and learning.

RELATED KNOWLEDGE

Continue Exploring

Explore related research, framework domains, and continuity concepts.
CONTINUE WITH THE FRAMEWORK

Explore the continuity relationships that support trustworthy organizational intelligence.

Continue through the GovKM Framework to examine the doctrine, knowledge, and implementation guidance behind Organizational Continuity.
Explore the Continuity FrameworkView All Articles