Plugin4Shell: 4 AI Coding Agents Hit, 2 Still Unpatched

Security firm AIR published research on September 17, 2026 describing "Plugin4Shell," a flaw that defeats the SHA pinning used by four of the most widely deployed AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. Researchers Or Nevo, Dor Granat and Niv Hoffman found that each agent checks out the exact plugin commit a marketplace pinned, but never verifies that the checkout actually landed on that commit.

For Claude Code, Codex and Copilot, the trick is a branch name. An attacker who controls the plugin's repository creates a branch named after the 40-character commit hash and makes it the default. Git prefers a matching reference over an object of the same name, printing only a "refname is ambiguous" warning, so the agent installs attacker-controlled code while reporting a successful install at the pinned commit. Gemini CLI fails differently: it fetches the pinned commit, then runs git checkout FETCH_HEAD, which resolves to a branch if the repository's default branch is itself named FETCH_HEAD. AIR's proposed fix is one assertion inside the agent: after checkout, compare git rev-parse HEAD with the pinned hash and abort if they differ.

What makes it zero-click is background auto-update, which AIR says is the default in Claude Code and Codex. A plugin the developer already installed and already trusts is swapped without a prompt or a click. AIR says it found the bug in May 2026 with a working proof of concept against all four agents and reported it to the vendors in June, under coordinated disclosure, publishing the details only this week.

The vendor responses diverged. Anthropic confirmed a fix in Claude Code 2.1.179 on June 17, 2026; the public changelog for that version lists routine fixes and does not mention the flaw. OpenAI's Codex 0.146.0 was verified fixed on August 12. Microsoft has shipped no fix for GitHub Copilot. Google told AIR on August 4 that it would not patch Gemini CLI because the tool is deprecated, advising users to move to Antigravity, which AIR says this attack does not reach. Help Net Security reported the same split on September 18.

One limit matters. The branch-name variant only works where a git host allows a 40-hex branch name: GitHub rejects those outright, AIR notes, while Bitbucket and self-hosted servers accept them, and Anthropic's own documentation lists both as valid marketplace backends. No CVE number has been assigned, and neither AIR nor Help Net Security reports any exploitation in the wild; the attack exists as a proof of concept. AIR sells agent-security products and says its own marketplace customers were not affected. For Copilot and Gemini CLI users, there is still no patch to install.

Disclosure: NewUJ's editorial process uses Anthropic's Claude models.