Plugin4Shell: the shared flaw that left four AI coding agents open to zero-click hijack
Air Security researchers found the same SHA-pinning flaw in Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI — letting an attacker swap a reviewed plugin for malicious code while the agent reported everything was fine. Anthropic and OpenAI have patched; Microsoft and Google have not.
Four of the most widely used AI coding agents shipped with the same security flaw: a weakness in plugin verification that let an attacker silently replace reviewed code with malicious code while the agent reported everything was fine. The vulnerability, dubbed Plugin4Shell by the Air Security researchers who found it, was disclosed publicly on September 17, 2026, with working exploits demonstrated against all four agents. Two are patched. Two are not.
That split is what makes this more than a routine patch bulletin. Two vendors shipped fixes; one has not patched Copilot, and Google will not patch Gemini CLI at all. For the enterprises running these tools, the question is no longer just whether to update, but how to manage tools whose fixes may never arrive.
How the flaw works#
AI coding agents install plugins from marketplaces that pin each plugin to a specific reviewed commit, identified by a 40-character SHA hash. The pin is a contract: whatever the plugin author pushes afterward, the agent runs exactly the code that was reviewed.
Plugin4Shell breaks the contract with a documented Git quirk: when resolving a name, Git checks symbolic references — branch and tag names — before raw commit objects. An attacker who controls a plugin's repository can create a branch whose name is the exact 40-character string of the pinned hash. The agent asks for the pinned commit; Git follows the branch instead; the attacker's code lands on disk. All four agents verified that the checkout command completed but never confirmed that the code they received actually matched the hash they requested.
The attack is zero-click: the victim needs only the plugin installed, and background auto-update re-runs the compromised checkout with no prompts and no reinstall. Plugin code runs with the developer's privileges — local files, environment variables, SSH keys, cloud credentials. A hijacked plugin is a hijacked workstation.
Researchers Or Nevo, Dor Granat, and Niv Hoffman built a working test attack against all four agents in May 2026 and notified the vendors in June, giving roughly three months of private remediation before publication. No in-the-wild exploitation had been reported at disclosure; no CVE number had been assigned.
Who is affected and what is patched#
| Agent | Status | Detail |
|---|---|---|
| Claude Code (Anthropic) | Patched in 2.1.179 | Shipped before public disclosure. Any install older than 2.1.179 remains vulnerable. |
| Codex (OpenAI) | Patched in 0.146.0 | Fixed release shipped around disclosure. |
| GitHub Copilot (Microsoft) | Not patched | No fix as of disclosure. Microsoft says platform-specific mitigations prevent exploitation in its environment; the researchers have not independently verified that claim. |
| Gemini CLI (Google) | Will not be patched | Google is deprecating the tool in favor of its Antigravity environment. Every existing installation stays vulnerable. |
The split response is instructive: two vendors treated the report as a defect and shipped; one is treating it as mitigated by environment; one is treating retirement as the fix.
Why four teams made the same mistake#
The uncomfortable detail is not that one team missed this, but that four independent teams missed it the same way. Each verified that the checkout succeeded; none verified that the result matched the pin. The shared assumption — if Git says we are on that commit, we must be on that commit — holds in every normal workflow and fails in the adversarial one.
The pattern is worth naming: SHA pinning is a young primitive in a young ecosystem, and agent plugin systems are roughly where npm and PyPI were years ago, before hash verification, package signing, and software bills of materials became standard. Air Security calls Plugin4Shell "the first supply chain vulnerability of the AI agent ecosystem" — an overstatement read literally, but directionally right about how exposed the agent plugin layer is.
There is also a structural reason this keeps happening to coding agents: they sit where powerful execution meets developer trust. An agent that can run your shell, read your files, and call your APIs is, by design, an ideal host for malicious code — which means every layer of the trust chain, including something as mundane as a git checkout, has to be airtight. It was not.
What to do now#
- Update Claude Code to 2.1.179 or later and verify with
claude --version; update CI runners and shared environments too. - Update Codex to 0.146.0 or later, with the same attention to pipelines and shared installs.
- Treat Copilot plugins as unverified external code until Microsoft ships an agent-side fix. Disable plugins you do not actively need, and prefer plugins from repositories your organization controls.
- Retire Gemini CLI. There will be no patch; migrate to Antigravity or another supported tool.
- Inventory plugin sources everywhere. Document which plugins are installed, which repositories they come from, and who controls those repositories. Public third-party repos are the attack surface.
What to watch#
- Whether Microsoft ships a Copilot fix — and whether its platform-mitigations claim survives independent scrutiny.
- When a CVE lands, and how quickly the two unpatched products move through enterprise patch tracking.
- Whether other agent platforms audit their own pinning. The bug class is unlikely to be confined to the four products tested; expect a wave of self-audits — or the next disclosure.
- Whether pinning gets replaced by verification. The durable fix is cryptographic: signatures and verification of what actually runs, the direction package ecosystems took a decade ago. Marketplaces that skip it are selling the illusion of a pin.