Security researchers have disclosed a flaw called Plugin4Shell in four widely used AI coding agents: Claude Code, OpenAI’s Codex, GitHub Copilot, and Gemini CLI. It lets an attacker silently swap in malicious code inside a plugin you already trust. The bug breaks SHA pinning, the safeguard meant to lock an installed plugin to one reviewed, trusted version of its code forever.
The research team at Air Security found the issue in May 2026. They disclosed it privately to Anthropic, OpenAI, Microsoft, and Google in June, giving each company months to respond before publishing on September 17. The outcomes differ by vendor, and that matters if you use any of these tools.
How the flaw works, in plain terms
When you install a plugin, a marketplace pins it to a specific, reviewed commit. That’s supposed to stop future updates from silently changing what code you’re running. Air Security found that the affected agents check out that pinned commit but never verify the checkout actually landed on it. An attacker who controls the plugin’s underlying repository can create a branch named after the pinned commit’s hash. If that branch is set as the default, the agent’s checkout resolves to the malicious branch instead of the trusted commit. Gemini CLI has a related but separate bug in how it fetches a pinned reference.
In Claude Code and Codex, plugins update automatically in the background by default. That means the swap can reach an agent that already has the plugin installed, with no click or prompt from the user. GitHub Copilot and Gemini CLI don’t auto-update the same way, so exploiting the flaw there would still need an install or update step to trigger.
What to do depending on which tool you use
- Claude Code: Anthropic shipped a fix in version 2.1.179 (confirmed June 17). Update to this version or later if you haven’t already.
- OpenAI Codex: OpenAI’s fix is in version 0.146.0, verified August 12. Update to this version or later.
- GitHub Copilot: Air Security says Microsoft had not shipped a client-side fix at the time of disclosure. GitHub told other outlets that GitHub itself blocks branch or tag names shaped like commit hashes. That limits the specific attack Air demonstrated to marketplaces whose plugin repositories live elsewhere, such as Bitbucket or self-hosted git servers. If your Copilot plugins come from a GitHub-hosted repository, your exposure to this exact method is lower; if they come from another host, it isn’t.
- Gemini CLI: Google told Air Security it will not patch this flaw. Gemini CLI itself was already being wound down separately, with Google steering users toward its newer Antigravity CLI. Air Security says Antigravity doesn’t have the marketplace plugin-pinning mechanism this attack targets.
Air Security frames the underlying problem as an industry-wide miss, not a one-off coding mistake: “One flaw, and every major lab made it.” The same missing check showed up independently across all four agents. Each one failed to confirm a checkout landed on the commit that was pinned, rather than just requested.
No exploitation in the wild has been reported for Plugin4Shell so far. If you use any of these agents with third-party plugins, the practical step is the same regardless of vendor. Check your installed plugin sources. Confirm you’re on a patched version where one exists. Be more cautious about plugins hosted outside GitHub, where the branch-naming trick works.
Editor’s note: Claude Code, made by Anthropic, is one of the four products covered here, and this post was written using an Anthropic model. The facts above are drawn directly from Air Security’s published disclosure.
Source: Air Security
