Security researchers at Air Security disclosed Plugin4Shell on September 17-18, a vulnerability class that breaks plugin SHA-pinning — the mechanism developers rely on to lock an installed plugin to a specific, reviewed commit — across all four major AI coding agents: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI. The flaw lets an attacker who controls (or later hijacks) a plugin’s source repository serve malicious code to every existing install while the pin still appears honored, with execution requiring no click, approval, or reinstall from the victim. Two of the four affected agents remain unpatched as of disclosure.

What happened

Each of these coding agents supports installing third-party plugins from a marketplace, with the marketplace recording the exact commit SHA a plugin was reviewed and pinned at. The security model rests on a simple assumption: naming a commit and verifying you received that commit are the same operation. Plugin4Shell shows they aren’t.

The root cause is Git reference-name ambiguity. Git can resolve a 40-character hex string as either a commit SHA or a branch name, and when both exist it doesn’t always pick the one an integrator expects. Air Security found that a plugin repository owner (or an attacker who compromises that repository) can create a branch whose name is identical to the previously pinned commit SHA and set it as the repository’s default branch. When an agent checks out “the pinned SHA,” Git can resolve the ambiguous reference to the branch instead of the original commit object — handing the agent attacker-controlled code while every pin-verification check the agent performs still reports success, because the reference it resolved does, technically, match the string it was told to pin to.

Researchers demonstrated two practical attack paths: submitting a benign plugin to a trusted marketplace and swapping in malicious code after it accumulates installs, or compromising a legitimate, already-trusted plugin author’s repository and pushing the poisoned branch to every existing install base at once. Because the update pulls automatically on the agent’s normal plugin-refresh cycle, no user interaction of any kind is required — this is a zero-click supply-chain compromise of a developer’s local machine or CI runner.

Technical details

  • Root cause: Git resolves an ambiguous 40-character reference as a branch name rather than the intended commit object hash, letting a repository owner redirect a “pinned” install to different code without breaking the pin check.
  • Attack requirement: control of the plugin’s source repository, either from the start (malicious-from-day-one plugin) or via later compromise (account takeover, leaked token, or maintainer handoff) of an established, trusted plugin.
  • Exploitation: zero-click — the swap takes effect on the agent’s routine plugin update/checkout, with no approval prompt or re-install action from the developer.
  • Affected agents: Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI — collectively representing the plugin ecosystems of the four most widely deployed AI coding agents.
  • Fix: after checkout, resolve the actual commit hash present in the working tree and abort if it doesn’t match the pinned SHA byte-for-byte, rather than trusting that the checkout of an ambiguous reference landed on the intended object.
  • Disclosure timeline: reported to all four vendors in June 2026; publicly disclosed September 17-18, 2026 after coordinated (and, for two vendors, incomplete) remediation.
  • No CVE has been assigned to Plugin4Shell as of this writing; it is being tracked by researcher- and vendor-assigned name only.

Impact

An AI coding agent runs with the same filesystem, network, and credential access as the developer or CI job invoking it — repository contents, SSH and API keys, cloud credentials, and often direct push access to source control. A plugin swap that achieves silent code execution inside that context is equivalent to compromising the developer’s own shell, and because agents are increasingly wired into CI pipelines for automated code review, test generation, and remediation, the same flaw reaches build infrastructure, not just laptops.

Patch status is split and, for two of the four vendors, unresolved:

  • Anthropic patched Claude Code in version 2.1.179.
  • OpenAI patched Codex in version 0.146.0.
  • Microsoft has not shipped an agent-level fix for Copilot; GitHub has pointed to marketplace-level SHA restrictions, which researchers argue do not close the underlying Git reference-ambiguity issue for plugin sources outside GitHub’s own hosting.
  • Google deprecated Gemini CLI rather than patch it, meaning every existing installation remains permanently exposed with no remediation path other than migrating off the tool entirely.

Organizations running Copilot or Gemini CLI plugins today have no vendor patch to apply and are exposed to this class of attack for as long as those installs remain in use.

Mitigation

  • Update immediately to Claude Code 2.1.179+ or Codex 0.146.0+ if you use either agent.
  • Treat Copilot and Gemini CLI plugin installs as unpinned until a real fix ships — SHA pinning currently provides no meaningful integrity guarantee for third-party plugins on either platform. Consider disabling third-party plugins on these agents in CI environments where the blast radius includes build credentials.
  • Audit which plugins your organization has installed across all four agents, and for any plugin sourced from a repository outside your direct control, verify the currently-resolving commit against the originally reviewed SHA using an unambiguous full-hash comparison rather than trusting the agent’s own reported pin status.
  • Restrict default-branch and branch-naming permissions on any plugin repository your organization publishes, since the attack depends on being able to set a branch name that collides with a prior commit SHA and make it resolve preferentially.
  • Scope agent credentials and CI runner permissions to least privilege regardless of patch status — a zero-click plugin RCE is far less damaging against an agent that can’t reach production secrets or push protected branches.

Sources: The Hacker News — Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents, Air Security — Plugin4Shell: Zero-Click RCE in Top 4 Coding Agents, The Register — AI coding agents’ 0-click RCE flaw could hand attackers keys to the kingdom, Help Net Security — Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched.