If you use an AI coding agent with plugins, one security flaw disclosed this week deserves ten minutes of your attention. Plugin4Shell, found by the research lab AIR Security, is a zero-click remote code execution bug that reaches four of the biggest coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. The worrying part is who it can hit. The Plugin4Shell vulnerability works even against people who did everything right, because it defeats the SHA pinning that marketplaces use to lock a plugin to a reviewed version. Two vendors have shipped fixes. Two have not.

Table of Contents

What Plugin4Shell Actually Is

AIR Security researchers Or Nevo, Dor Granat and Niv Hoffman named the flaw Plugin4Shell and published it on September 17 and 18, depending on which report you read. According to The Register, they had told all four vendors back in June. The researchers call it the first supply-chain vulnerability to hit the AI agent ecosystem.

The key detail is what it targets. This is not a jailbreak or a prompt trick aimed at a model. It goes after the distribution layer, the marketplaces and repositories that feed plugins, skills and extensions to coding agents. Those add-ons usually run with the same permissions as the developer, which can include source code, cloud credentials, SSH keys and internal repositories.

It is also zero-click. Reports from Startup Fortune and AiCybr explain that plugins can refresh after the original install, so malicious code can simply turn up on a later update, with no prompt, approval or reinstall.

How the SHA-Pinning Bypass Works

What pinning is supposed to guarantee

When a marketplace approves a plugin, it records the exact Git commit that was reviewed, identified by a 40-character hash called a SHA. The point of pinning is simple: once a version passes review, it should not change without the developer knowing.

Where the check goes missing

According to Forkast's summary of the research, the affected agents ask Git for the pinned SHA but never confirm that the files they end up with actually match it. That opens a gap. For Claude Code, Codex and GitHub Copilot, an attacker who controls the plugin's repository can create a branch whose name imitates the approved hash, and Git may resolve that name instead of the reviewed commit. Gemini CLI has a separate variant tied to how it fetches and checks out a commit, but the outcome is the same.

Why the fix has to live inside the agent

Because the failed verification happens on the developer's machine, marketplaces cannot repair it from their side. They can keep advertising a pin that the agent does not truly honor. Updating the agent is the only real mitigation.

Who Has Patched and Who Hasn't

The response has been uneven, and the differences are worth knowing before you decide what to do.

  • Claude Code: fixed in version 2.1.179, per The Register and AiCybr.
  • OpenAI Codex: fixed in version 0.146.0.
  • Gemini CLI: Google has deprecated it, so it will not be patched and every install stays vulnerable. Google points users to its newer Antigravity environment, which The Register reports is protected against this attack.
  • GitHub Copilot: no client fix was available at disclosure. A GitHub spokesperson told The Register that GitHub blocks branch and tag names that look like commit SHAs, so the attack cannot work there. AIR says that mitigation is not enough.

Scale makes the Copilot gap matter. The Register notes that Microsoft says almost 90 percent of Fortune 500 companies use Copilot.

Why This Bug Matters More Than Most

Our read: the specific Git trick is less important than the assumption behind it. Startup Fortune points out that four separate engineering teams at four companies built the same trust into their update pipelines, and none caught it until an outside lab did. SHA pinning had become a label people trusted, when in practice nobody was verifying what actually landed on disk.

The bigger shift is in the threat model. Most public AI-agent security talk focuses on tricking the model. Plugin4Shell shows an attacker can skip the model entirely and target the plumbing around it. AIR's earlier SkillJacking research, as Startup Fortune describes it, found 925 skills quietly swapped from their original maintainers, reaching roughly 134,000 agents. This new flaw suggests hijacking may not even need a stolen maintainer account.

To keep this in proportion: AiCybr notes the attack works under specific repository conditions, meaning the attacker has to control the plugin's repository. In the coverage we reviewed, there were no reports of exploitation in the wild. But agents that act with a developer's full permissions raise the stakes of any weakness, which we also saw in our report on the Gemini test breakout. And as models get better at terminal work, a trend visible in our look at GPT-5.6 Sol's Terminal-Bench results, more real work will flow through exactly these agents.

The Disclosure Timeline

The vendors were told in June, and the details went public in mid-September, so patched vendors had roughly three months to ship. Anthropic and OpenAI did. Google has deprecated the affected tool instead of patching it. Microsoft did not ship a client patch, and the GitHub position remains disputed by the researchers.

It is easy to read too much into that. Deprecating a product is a legitimate way to end a support burden, and GitHub may well be right about its own platform. Still, if you are a team standardizing on one agent, the patch status here is real information about how each vendor treats plugin security, and it belongs in your evaluation.

What Developers and Teams Should Do Now

These are our practical suggestions, not an official advisory, so check each vendor's own security notes too.

  • Update now. Move Claude Code to 2.1.179 or later and Codex to 0.146.0 or later.
  • Leave Gemini CLI. Google says it will not fix it, so migrating to a supported tool is the safer route.
  • Be careful with Copilot plugins until Microsoft and GitHub settle the disagreement about the mitigation.
  • Audit what is installed. Remove plugins and skills you do not use, and prefer ones from maintainers you know.
  • Shrink what an agent can reach. Keep production credentials, SSH keys and cloud secrets out of the environment where the agent runs, and use a separate development sandbox.
  • Check auto-update settings. Where your tool lets you review plugin updates before they apply, turn that on.

None of this is exotic. It is the same least-privilege thinking security teams already apply to any tool that can execute code on a laptop.

Frequently Asked Questions

What is Plugin4Shell?

Plugin4Shell is a zero-click remote code execution vulnerability found by AIR Security. It bypasses SHA pinning in the plugin systems of four major AI coding agents, letting attacker-controlled plugin code run instead of the reviewed version.

Which AI coding agents are affected?

Claude Code, OpenAI Codex, GitHub Copilot and Google's Gemini CLI. Claude Code and Codex have patched versions, Gemini CLI is deprecated without a fix, and Copilot had no client patch at disclosure.

Do I have to click anything to be affected?

No. That is why it is called zero-click. Malicious code can arrive during a plugin refresh with no approval step, although the attacker must control the plugin's repository for the attack to work.

What should I do right now?

Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later, move off Gemini CLI, review your installed plugins, and keep sensitive credentials away from the environment where your agent runs.