Plugin4Shell exposes AI coding agents to pinned plugin swaps
Air Security has disclosed Plugin4Shell, a vulnerability affecting four AI coding agents that can let a plugin repository owner substitute malicious code for a plugin pinned to a reviewed commit. The affected tools are Anthropic Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI. Air says Anthropic fixed the issue in Claude Code 2.1.179 and OpenAI fixed it in Codex 0.146.0; no Copilot patch was available as of September 18, while Google will not patch the retiring Gemini CLI.
The issue concerns plugin marketplaces that record a commit hash to identify an exact reviewed snapshot of repository code. Air found that the agents retrieve the requested revision but do not verify that the materialised code ultimately matches the pinned hash. A repository owner can therefore exploit Git name resolution on certain hosts to make the agent install different code while continuing to display the locked version.
How the plugin substitution works
On a Git host that permits a branch name designed to resemble a commit hash, an attacker controlling the plugin repository can point that branch at code of their choice. Git may interpret the requested hash as a branch name, rather than the intended immutable commit. OpenAI described the same behaviour in its public Codex fix, warning that plugin source can materialise a different commit from the one it pinned.
The consequence is significant because plugins execute with the access available to the person running the coding agent. Swapped plugin code could access local files, stored credentials and systems the user is able to reach. Air demonstrated a working test against all four products in May and notified vendors in June. As of September 18, no CVE had been assigned, no vendor security advisory had been published, and there was no indication of exploitation in real-world attacks.
Where the exposure exists
The hash-shaped branch technique does not apply to GitHub repositories because GitHub disallows branch or tag names that look like commit hashes. The default plugin catalogues checked for Claude Code and Copilot, along with Anthropic’s community catalogue, pointed to GitHub repositories. Users relying solely on those GitHub-based default marketplaces are therefore not exposed to this specific branch-name path.
The risk remains relevant for plugins hosted on Bitbucket or corporate Git infrastructure, where such names may be accepted and where these agents can also obtain plugins. The associated risks in Claude Code and Gemini CLI CI workflow vulnerabilities include CI workflows, while Plugin4Shell focuses on the integrity of the plugin code obtained after a version lock has been applied.
Gemini CLI has a separate reported path involving a repository whose main branch is named FETCH_HEAD. GitHub’s restriction on hash-like names does not clearly prevent that name, so it is not established that GitHub-hosted Gemini CLI plugins are unaffected. Google has stopped serving the consumer Gemini CLI and directs users to Antigravity, which Air says is not vulnerable; enterprise Gemini CLI access is due to continue, though the status of a fix is unclear.
Update agents and control plugin sources
Background plugin updates could allow a previously trusted plugin to be replaced without a new prompt. Air says automatic updates are enabled by default in Claude Code and Codex, although documentation indicates that this default applies to their built-in GitHub-hosted marketplaces rather than external sources. The available fixes must be delivered by each agent because lock verification happens locally, not in the marketplace.
Teams should update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later, while treating Copilot installations from non-GitHub hosts as unpatched. They should inventory plugin origins, limit repositories to controlled hosts and trusted catalogues, and assess the credentials and system access granted to developer-agent environments before allowing third-party plugin code to run.