Four of the most widely used AI coding agents, Claude Code, OpenAI Codex, GitHub Copilot and Google’s Gemini CLI, shared the same critical design flaw in how they install third-party plugins. Security research firm AIR disclosed on September 17 that the bug, which it calls Plugin4Shell, lets an attacker silently swap a trusted, already-reviewed plugin for malicious code, with no click, no prompt and no warning to the user. Two of the four vendors have shipped fixes. One has not. The fourth has stopped supporting the affected product entirely rather than patch it.
What SHA pinning was supposed to guarantee
Coding agents extend themselves the same way browsers do: through plugins and skills installed from a marketplace. Enterprises overwhelmingly pull these from open, community-run marketplaces rather than a vetted enterprise one, and the agent runs with the same access to source code, credentials and internal systems as the employee operating it. A malicious plugin does not need to escalate privileges. It inherits them.
The industry’s safeguard against a trusted plugin turning malicious later is SHA pinning: review a plugin’s code once, lock the install to that exact commit hash, and treat the pin as a permanent guarantee that the reviewed code is what keeps running. AIR researchers Or Nevo, Dor Granat and Niv Hoffman wrote in the company’s disclosure that Plugin4Shell is “the story of that boundary failing.” According to AIR, every one of the four agents checks out the commit its marketplace told it to pin, but none of them verifies that the checkout actually landed on that commit. An attacker who controls the repository behind a plugin can make the checkout resolve to different, malicious code while the recorded pin looks untouched.
Media Partner
Why it needs no click
AIR’s disclosure lays out two ways in. In the first, an attacker publishes a plugin that behaves exactly as advertised, passes review, and only later turns the same repository malicious. AIR says it has already proven this works at scale in earlier research, when a plugin it built spread to more than 26,000 agents before being pulled. In the second, an attacker takes over the repository behind a plugin someone else wrote and users already trust, a technique AIR calls SkillJacking, which it says has already compromised 925 skills in active use across 134,000 agents by exploiting expired maintainer domains and lapsed repository ownership.
What makes Plugin4Shell zero-click is that the vulnerable checkout is not limited to install time. Coding agents auto-update installed plugins in the background, a default behavior in Claude Code and Codex, so when a marketplace bumps a plugin’s pinned commit, the same flawed checkout logic runs again on every machine that already has the plugin installed. Nobody has to approve anything. The swap reaches a plugin a security team already reviewed, already pinned, and already trusted.
One design error, four vendors
The specific mechanism differs slightly by agent. Claude Code, Codex and GitHub Copilot share a version rooted in how git resolves ambiguous names: when a repository’s default branch happens to be named the same 40-character string as the pinned commit hash, git prefers the branch over the commit, and the checkout silently resolves to whatever the attacker has put on that branch. GitHub itself rejects a branch name that looks like a commit hash, but other git hosts, including Bitbucket and self-hosted servers that AIR notes Anthropic’s own documentation lists as supported marketplace backends, do not block it. Gemini CLI is exposed through a related but distinct flaw in how it fetches and checks out a pinned reference, with the same end result: the code that runs is not the code that was reviewed.
AIR’s own framing of the finding is blunt about what that repetition means: it is not one product’s implementation slip but, in the firm’s words, “one flaw, and every major lab made it.” That framing is itself part of the story. Plugin4Shell is the first disclosed vulnerability to target the distribution layer beneath AI coding agents rather than the model or the agent’s own guardrails, and the fact that four independently built products converged on the identical missing check suggests the industry has been designing plugin trust around the same unverified assumption.
An uneven vendor response
AIR found the bug in May 2026 and disclosed it to all four vendors the following month, with working proof-of-concept exploits against each. The response since has split sharply. Anthropic shipped a fix in Claude Code version 2.1.179, which Anthropic’s own public release notes for that build, reviewed by CyberTech, do not itemize as a security fix, consistent with the vendor’s practice of not detailing coordinated-disclosure patches in its changelog. OpenAI’s own GitHub release notes for Codex version 0.146.0 are more explicit, listing “verify Git plugin SHA checkouts” among the changes and confirming a checksum-validation fix for plugin downloads.
Microsoft, told about the identical flaw in GitHub Copilot, has not shipped a fix, according to AIR, leaving Copilot users with no patched version to move to. Google has gone the furthest in the other direction: rather than patch Gemini CLI, it is deprecating the product outright. Google framed that decision as a product roadmap shift months before Plugin4Shell’s disclosure, not as a security response. In a company blog post announcing the transition to a successor product called Antigravity, Google’s Dmitry Lyalin, Group Product Manager, and Taylor Mullen, Principal Engineer, wrote that “your workflows have simply outgrown those early days of 2025” and that users “now require multiple agents communicating with each other to split up the work and solve complex problems.” Whatever the original motivation, the practical effect for security teams is that Gemini CLI will not receive a fix and Google’s own advice to affected users is to migrate to Antigravity, which AIR notes does not use a marketplace plugin-pinning system this attack relies on.
The third act of a pattern AIR has been documenting
AIR frames Plugin4Shell as the third finding in a line of research into the same trust model. The first, which the firm calls The Story of Skills, demonstrated that getting a malicious plugin into a trusted marketplace in the first place was not the hard part: a benign-looking plugin AIR built spread organically to more than 26,000 agents before it was pulled. The second, SkillJacking, showed that an attacker does not even need to plant anything new. AIR says it found 925 skills already in active use across 134,000 agents that had been hijacked from their original maintainers, typically through lapsed domains or abandoned repository ownership rather than any flaw in the skill’s code.
Plugin4Shell closes the loop between those two findings and the control the industry built specifically to contain them. SHA pinning exists because marketplace operators know plugins can be planted or hijacked after the fact, which is exactly what the first two pieces of AIR’s research proved happens in practice. Plugin4Shell shows that the mechanism meant to make a takeover harmless, by freezing what actually runs at a reviewed commit, does not hold under either attack path. A security team that read AIR’s earlier research and concluded that pinning and code review were sufficient compensating controls was relying on a guarantee that, as of this disclosure, none of the four major agents actually enforced.
That sequencing also explains why AIR frames this as an ecosystem problem rather than a single vendor’s bug. Marketplace operators can only enforce controls that are checked on their own infrastructure. Because the pin is resolved by the agent itself, on the developer’s own machine, after the plugin has already been downloaded, no marketplace-side control, however strict its review process, can detect or block a checkout that silently resolves to different code than the one it approved. The fix has to live in the client, which is precisely the layer the four vendors have now responded to with four different degrees of urgency.
Detecting exposure without a vendor patch
Where a fix has not shipped, AIR’s own guidance is that updating the agent is the only complete mitigation, but security teams do not have to wait passively. Auditing which plugins are installed across a developer fleet, and cross-referencing their pinned commits against the actual commit history of the upstream repository, can surface a mismatch even without a vendor-side detection feature, since the whole flaw hinges on the checked-out commit differing from the one the marketplace recorded. Teams that maintain their own internal plugin mirror or vetted marketplace, rather than pulling directly from public, community-run repositories, reduce the number of upstream repositories an outside attacker could take over in the first place, though AIR’s research on SkillJacking shows that even reputable, long-maintained plugins are not immune once a maintainer’s domain or account lapses.
What it means for the security leader
Plugin4Shell should change how security teams evaluate any AI coding agent’s plugin ecosystem, not just the four named here. First, SHA pinning claims need verification, not trust. If a vendor’s marketplace advertises commit pinning as a control, a security team should ask specifically whether the agent confirms the resolved checkout matches the pinned hash, not merely whether a hash was recorded. AIR’s technical detail shows the fix is a single assertion after checkout, and its absence is what turned a design feature into a false sense of safety.
Second, background auto-update is the multiplier. The same design gap exists whether or not auto-update is enabled, but auto-update is what makes it reach installed, already-trusted plugins with zero user interaction. Security teams that allow developers to run coding agents with plugins should know whether auto-update is on by default for that product, since that setting determines whether this class of bug is a one-time install risk or a standing exposure that can be triggered on someone else’s schedule.
Third, an unpatched or deprecated dependency does not remove itself from the fleet. GitHub Copilot users have no vendor fix to apply today. Gemini CLI users have a migration path, not a patch, and every existing install stays exposed until it is replaced. Both situations call for the same response as any unpatched, actively-disclosed vulnerability in enterprise tooling: inventory where these agents run, restrict or remove third-party plugin installation where it is not essential, and treat “migrate to a new product” as the remediation timeline it actually is, not a lower-priority footnote.
The defender’s next step
Security teams running Claude Code or OpenAI Codex should confirm they are on Claude Code 2.1.179 or later and Codex 0.146.0 or later, since AIR’s disclosure identifies those as the fixed versions. Teams running GitHub Copilot with plugin installation enabled should treat the plugin marketplace as an unmitigated risk until Microsoft ships a fix, and consider restricting plugin installation to a reviewed allowlist in the interim. Teams running Gemini CLI should begin planning the migration to Antigravity now rather than waiting for the June 2026 cutover Google has already announced, since no patch is coming for the underlying agent. Across all four, the broader lesson holds regardless of vendor: a pinning guarantee that is resolved entirely on the client, as AIR notes it is here, is only as strong as the verification step after the checkout, and that step was missing everywhere it needed to exist.
CyberTech previously covered how a hijacked AI coding assistant became a supply-chain delivery mechanism in its own right and how a self-propagating worm began hunting AI agent credentials specifically. Plugin4Shell extends that pattern one layer further down, into the distribution mechanism every major agent shares.
Source: AIR
