Plugin4Shell

A plugin pinned to a reviewed commit hash should install that exact code. That assumption underpins how most organizations secure AI coding agents. In September it failed across all four major ones.

The broken check

The AIR Security research lab named the flaw Plugin4Shell. Researchers Or Nevo, Dor Granat, and Niv Hoffman found it in May 2026 and built working exploits against Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. They disclosed to each vendor the following month.

The mechanics are simple enough to explain in a paragraph. A marketplace or your security team reviews a plugin at a specific Git commit and records that commit's SHA hash. The agent should then fetch exactly that code.

The affected agents request the pinned SHA during Git checkout. None of them verify that the checked-out working tree matches it. That gap runs straight into Git reference-name ambiguity: an attacker creates a branch whose name is the same 40-character hexadecimal string as the pinned commit, sets it as the default branch, and Git may resolve the branch instead of the commit. The agent installs attacker code while reporting a successful install of the trusted version.

One missing verification step removes the entire pinning guarantee.

Why nobody has to click anything

Several coding agents update installed plugins automatically. An attacker can publish a benign plugin, pass marketplace review on merit, wait for adoption, and swap the code later. The victim takes no action and makes no mistake.

The researchers made this point directly, and it undercuts the usual "users install sketchy things" defense. Exposure requires only that a plugin is installed, from a marketplace you trust, reviewed and pinned the way the security model intends.

The blast radius follows from what plugins can reach. Agent plugins, skills, and extensions run with the permissions of the developer operating the agent: source code, secrets, cloud environments, production systems, internal services, enterprise data. An attacker gets the same reach as the employee.

AIR calls Plugin4Shell the first true supply-chain vulnerability of the AI agent ecosystem. Earlier agent security research went after the model or the agent's reasoning. This one targets the distribution layer, the marketplaces feeding code to millions of machines.

Patch status differs by vendor

• Claude Code: patched by Anthropic in 2.1.179
• Codex: patched by OpenAI in 0.146.0
• GitHub Copilot: Microsoft received the report and has not shipped a fix
• Gemini CLI: Google deprecated the CLI instead of patching it, and points users at Antigravity

Deprecation is not remediation. An install on a developer's machine stays vulnerable after the vendor stops supporting it. If Gemini CLI runs anywhere on your team, migrating off it is now a security task, not a roadmap item.

Marketplaces cannot fix this centrally

You might expect GitHub or whichever marketplace you use to close the gap for everyone. AIR is explicit that it cannot: the verification check runs inside the agent, not at the marketplace. Each vendor has to fix it in the agent.

Updating is the complete fix wherever one exists. Copilot and Gemini CLI have no configuration that restores the pinning guarantee.

Four things to do now

• Update Claude Code to 2.1.179+ and Codex to 0.146.0+. A real fix exists for both.
• Treat Gemini CLI installs as a migration task. No patch is coming.
• Assume pinning does not protect Copilot. Review which secrets and production access sit in the environments where it runs, and reduce what a successful plugin swap would reach.
• Audit installed plugins across your team's agents. A pinned plugin from a trusted marketplace was the failing scenario, so "we only install reviewed plugins" describes the problem rather than the defense.

The same layer failed twice in one month

GitSpawn came earlier in September: a malicious .git/config executed code across Claude Code, Codex, Cursor, and four other agents, and four vendors were still unpatched at a September 1 retest.

The tooling around agents matured faster than the verification underneath it. Marketplaces, SHA pinning, and approval layers all existed. None of them were enforced end to end. Expect more of these, and treat each one as a class of bug rather than an isolated incident.

The full write-up has the vendor-by-vendor patch table and source links: https://www.hamvero.space/blog/plugin4shell-ai-coding-agents/