The Pulse
Plugin4Shell Breaks SHA Pinning in Four AI Coding Agents
AIR Security says Plugin4Shell enables zero-click remote-code execution by bypassing plugin SHA pinning in Claude Code, Codex, GitHub Copilot and Gemini CLI.
AI.info Team ·
One flaw reaches four coding agents
Four major AI coding agents share a zero-click remote-code-execution flaw that can defeat the SHA pinning meant to keep installed plugins tied to reviewed code, according to AIR Security. The vulnerability, named Plugin4Shell, affects Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot and Google’s Gemini CLI.
“Plugin4Shell is a zero-click, high-severity RCE affecting all four major AI coding agents - Claude Code, Codex, Copilot, and Gemini.” — AIR Security researchers Or Nevo, Dor Granat and Niv Hoffman
AIR Security says the flaw allows a trusted plugin to be silently replaced with malicious code and installed without user interaction. Because these agents can operate with the permissions of the developer running them, a compromised plugin may gain access to local files, credentials, internal systems and production environments.
The company disclosed the issue to all four vendors in June 2026 after building a working proof of concept against each agent in May. AIR Security published its findings on September 17, 2026.
How Plugin4Shell defeats a reviewed commit
Plugin marketplaces use commit hashes, often called SHAs, to identify the exact version of a plugin that has been reviewed. The mechanism is intended to prevent a repository owner or attacker from changing the code after approval and having the agent download a different version.
AIR Security found that the affected agents resolve the requested SHA inside the local Git operation but do not verify that the resulting working tree actually matches the pinned commit. Git can interpret a requested commit-shaped value as a branch name in certain repository configurations. An attacker who controls the plugin repository can exploit that behavior to make the agent retrieve a different commit from the one the marketplace recorded.
The failure sits inside the agents rather than in the marketplaces themselves. AIR Security says a marketplace cannot impose the missing verification after the agent begins resolving the plugin, leaving an agent-side update as the complete fix.
Claude Code and Codex have patches
Anthropic patched Claude Code in version 2.1.179 after AIR Security’s disclosure. OpenAI fixed Codex in version 0.146.0, which AIR Security says it verified as patched on August 12, 2026.
Users of those tools need to update to the fixed versions or later releases. The disclosure describes the vulnerability as zero-click because plugin installation and updates can occur automatically, removing the approval step that might otherwise expose a changed package.
Copilot remains without a fix
AIR Security says it disclosed the same flaw to Microsoft, but Microsoft has not shipped a fix for GitHub Copilot. The company’s disclosure therefore leaves Copilot users without an agent-side patch for the issue described.
The distinction matters because changing marketplace behavior cannot repair an already vulnerable client. AIR Security says a marketplace might reduce one version of the attack by restricting repositories that accept SHA-shaped branch names, but that approach would limit support for repositories the agents officially allow and would not address the Gemini CLI variant.
Google will retire Gemini CLI
Google has deprecated the Gemini CLI and told AIR Security that it will not issue a patch. Every existing installation remains vulnerable to the disclosed flaw, according to the company.
AIR Security advises Gemini CLI users to migrate to Google’s Antigravity instead. The disclosure says Antigravity is not affected because it does not use the marketplace plugin SHA-pinning mechanism targeted by Plugin4Shell.
The risk comes from inherited permissions
AI coding agents often run with the same practical reach as the developer using them. Plugins inherit those permissions, so a malicious add-on does not need to find a separate privilege-escalation bug before reading sensitive files, accessing development systems or executing commands.
AIR Security characterizes Plugin4Shell as the first supply-chain vulnerability aimed at the distribution layer of the AI-agent ecosystem rather than at a model or a single agent implementation. The shared design error means that one repository-control problem can affect users of several competing products at once.
The immediate remediation is uneven: Claude Code and Codex have fixed versions, Copilot has no patch, and Gemini CLI is being retired without one. Organizations using any of the four agents must therefore identify installed plugins, update patched products and remove or replace vulnerable Gemini CLI deployments.