On September 17, security research lab AIR Security disclosed Plugin4Shell, a zero-click remote code execution flaw that breaks the version-pinning safeguard every major AI coding agent uses to trust its plugins. Not one agent. Four of them, sharing the exact same mistake: Claude Code, OpenAI Codex, GitHub Copilot, and Google’s Gemini CLI all check out a plugin’s pinned commit hash without verifying the checkout actually landed on that commit. Name a git branch the same as the SHA, and the agent installs your branch instead. It still reports a clean, verified install.

That’s not a minor implementation quirk. It’s the mechanism every one of these agents leans on to promise “we only run reviewed code,” quietly not doing what it claims. The Register, Help Net Security, and Cybersecurity News all picked up the disclosure independently within a day of each other, which tells you how the security press rated the severity here.

Quick Summary: What Happened

Detail	Info
Disclosed	September 17-18, 2026, by AIR Security
Vulnerability	SHA-pinning bypass enabling zero-click RCE in plugin/extension installs
Affected agents	Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI
Attack method	Naming a git branch to match the pinned 40-character commit SHA (or FETCH_HEAD for Gemini CLI)
Patched	Claude Code 2.1.179 (Anthropic), Codex 0.146.0 (OpenAI)
Unpatched at disclosure	GitHub Copilot (Microsoft, no fix shipped); Gemini CLI (Google, will not patch, deprecated)
Exploited in the wild	AIR reports no evidence of active exploitation

Bottom line: A single flaw in how four competing AI coding agents verify plugin installs lets a malicious update run attacker code with zero clicks and full inheritance of the developer’s own access. Two of the four vendors still haven’t shipped a fix.

What Actually Happened

SHA pinning is supposed to be the boring, reliable part of plugin security. You install a plugin, the marketplace or manifest records its commit hash, and every future update is supposed to be checked against that hash before anything runs. It’s the same trust model package managers have used for years. According to AIR’s write-up: “Every affected agent checks out the pinned commit but never checks that it actually landed there.” The hash gets recorded correctly, but nothing downstream confirms the code on disk actually matches it.

Git’s own ref-resolution behavior is what makes that gap exploitable. When an agent runs the equivalent of git checkout <SHA>, git will resolve a branch name over a commit object if both share the same identifier. So an attacker who controls a plugin’s repository (either by shipping a clean version first and swapping it after review, or by hijacking an existing maintainer’s repo through leaked credentials) creates a branch literally named after the 40-character SHA the agent has pinned. Checkout resolves to the malicious branch. The agent reports a successful, verified install. Nothing about the reported hash changes.

Gemini CLI’s variant works slightly differently: instead of a SHA-named branch, the attack abuses a branch named FETCH_HEAD, which git checks out in place of the actually-fetched commit. Different ref, same underlying failure. The agent trusts what git resolves instead of confirming what actually landed on disk.

Which AI Coding Agents Does Plugin4Shell Affect?

1. Claude Code: Anthropic patched the flaw in Claude Code 2.1.179, confirmed fixed as of AIR’s disclosure.
2. OpenAI Codex: Patched in Codex version 0.146.0.
3. GitHub Copilot: Microsoft had not shipped a fix at disclosure time, per Help Net Security’s reporting.
4. Google Gemini CLI: Google confirmed it will not patch the deprecated CLI and is directing users toward its successor tooling instead.

The blast radius isn’t theoretical. A compromised plugin runs with the same permissions as the developer account that installed it: local source code, cloud credentials, SSH keys, access to internal repos, and in plenty of setups, a straight line to production. AIR’s research previously turned up a related supply-chain problem it called “SkillJacking,” finding hundreds of compromised skills sitting in these same plugin ecosystems. Plugin4Shell is the mechanism that would let an attacker weaponize exactly that kind of foothold without the victim clicking anything.

Why This Matters

Zero-click is the part that should worry teams more than the RCE label alone. Both Claude Code and Codex update installed plugins in the background by default. That’s a feature, meant to keep security patches and improvements flowing without nagging developers for approval on every update. Plugin4Shell turns that same convenience into the delivery mechanism. A developer who installed a plugin weeks ago, reviewed it once, and never thought about it again can have it silently swapped out from under them on the next automatic sync.

Pinning to an immutable hash instead of a mutable reference is exactly the lesson the software industry drew from the tj-actions/changed-files compromise, where an attacker rewrote a popular GitHub Action’s version tags to point at malicious code and more than 23,000 repositories inherited it without anyone changing a single dependency declaration. SHA pinning exists precisely to close that hole: a 40-character hash isn’t supposed to move the way a tag or branch name can. What makes Plugin4Shell notable isn’t that one vendor’s checkout logic had a gap. It’s that four separate engineering teams, working independently, all resolved git refs the same permissive way and none of them caught it before an outside researcher did. That’s not a single company cutting a corner. It’s a shared blind spot baked into how an entire category of tools verifies the code it runs.

The patch gap makes this concrete and current, not historical. Anthropic and OpenAI both closed the hole. Microsoft and Google haven’t, for different reasons — Microsoft simply hasn’t shipped a fix yet, and Google has effectively decided Gemini CLI isn’t worth fixing since it’s being phased out. Neither reason changes what’s true for anyone still running GitHub Copilot’s plugin system or Gemini CLI today: the exploit AIR described still works.

What Are Your Options Now

If you use Claude Code or Codex, update to 2.1.179 or 0.146.0 respectively (or later) if you haven’t already. Automatic updates should have handled this for most users, but confirm your version rather than assuming.

If you use GitHub Copilot’s plugin or extension system, treat every installed extension as unverified until Microsoft ships a fix. Review what’s currently installed, and hold off on adding anything new from an unfamiliar publisher.

If you’re still running Gemini CLI, Google has told users directly it won’t patch this. That’s as close to an official migration notice as it gets: move to Google’s current-generation agent tooling rather than waiting on a fix that isn’t coming.

If you maintain a plugin published to any of these marketplaces, lock down write access to your repository now. Credential and token theft is one of the two attack paths AIR describes, and it’s the one you actually control.

If your org runs any of these agents at scale, this is worth raising with whoever owns your agent security posture. Self-hosting or sandboxing an agent’s execution environment doesn’t neutralize this bug, because the malicious code still runs with the developer’s own credentials, wherever that environment lives.

The Bigger Picture

Plugin4Shell is the clearest evidence yet that AI coding agents have inherited software supply-chain risk without inheriting the maturity that’s supposed to come with it. npm, PyPI, and other package ecosystems spent years (and multiple high-profile incidents) building out signature verification, provenance attestation, and marketplace review processes that still get bypassed regularly. AI agent plugin marketplaces are running the same playbook on a compressed timeline, and Plugin4Shell shows the pinning mechanism itself, the most basic layer of that trust model, wasn’t actually verified end to end by any of the four vendors that shipped it.

The 90-day gap between AIR’s private disclosure in June and the September public write-up gave every vendor equal time to respond. Two used it. Two didn’t. That split is going to be the more interesting story over the next few months than the vulnerability itself: whether Microsoft ships a fix under public pressure the way Anthropic has, under similar pressure, walked back other Claude Code decisions this year, and whether Gemini CLI’s user base actually migrates or just keeps running exposed tooling because migration is friction nobody wants to deal with.

Our Take

We think the four-vendor angle is the story, not the individual bug. A single implementation mistake is normal. Software has bugs. Four competing companies independently building the same unverified trust assumption into their plugin systems is a signal that nobody in this space is currently doing the kind of adversarial testing the stakes call for. These agents run with real credentials against real infrastructure. That’s the entire value proposition. It’s also exactly why “we forgot to verify the checkout” is a much bigger deal here than it would be in a tool with no ambient access to anything.

Anthropic and OpenAI patching within the 90-day window is the right outcome and deserves credit as the baseline, not praise as exceptional. Microsoft missing that window on a widely-deployed product is a harder miss to excuse, especially for a company that’s been pushing Copilot deeper into enterprise workflows all year. Google’s call not to patch a deprecated product is defensible in isolation (you don’t invest engineering time in something you’re sunsetting), but it leaves every developer still on Gemini CLI exposed with no vendor fix coming, ever, for this specific hole. If you’re one of them, that’s not a risk to sit on.

Frequently Asked Questions

What is Plugin4Shell?

Plugin4Shell is a zero-click remote code execution vulnerability, disclosed by AIR Security on September 17, 2026, that affects the plugin-loading systems of Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. It breaks SHA-pinning, the mechanism these agents use to verify that an installed plugin matches a specific, reviewed commit, by exploiting how git resolves branch names that match a pinned commit hash.

Is Plugin4Shell being actively exploited?

AIR Security says it found no evidence of active exploitation in the wild as of its September 2026 disclosure. That doesn’t mean it’s safe to ignore: the technique is now public, and unpatched agents remain exploitable.

Do I need to click anything for Plugin4Shell to affect me?

No. That’s what makes it zero-click. Claude Code and Codex both update installed plugins automatically in the background, so a malicious update can reach an already-installed plugin without any user action or approval.

Which AI coding agents have patched Plugin4Shell?

Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in version 0.146.0. GitHub Copilot had no fix shipped as of disclosure, and Google will not patch Gemini CLI, which it has deprecated in favor of newer tooling.

What can a Plugin4Shell attack actually access?

A compromised plugin inherits the same permissions as the developer account that installed it. That can include local source code, cloud credentials, SSH keys, internal repositories, and production systems, depending on what that developer’s account already has access to.

Does self-hosting my AI coding agent protect against Plugin4Shell?

No. Self-hosting controls where an agent’s sessions run, not whether an installed plugin is legitimate. A malicious plugin exploiting Plugin4Shell runs with the developer’s own credentials regardless of whether the agent is hosted on Anthropic’s infrastructure, OpenAI’s, or your own servers.

Why did some vendors patch and others didn’t?

Anthropic and OpenAI both shipped fixes within AIR’s 90-day responsible disclosure window. Microsoft had not released a fix for GitHub Copilot as of the September disclosure. Google opted not to patch Gemini CLI because the product is already deprecated, directing users to migrate to its current agent tooling instead.

---

Last updated: September 21, 2026. Sources: AIR Security — Plugin4Shell disclosure · The Register — AI coding agents’ 0-click RCE flaw could hand attackers keys to the kingdom · Help Net Security — Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched · Cybersecurity News — Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI.

Related reading: Claude Code Self-Hosted: The Fix for Rogue Agents? · Model Context Protocol: The USB-C Standard for AI · Anthropic Cuts Claude Code Weekly Limits by 17% · GPT-5.3-Codex vs Claude Sonnet 4.6 · GitHub Copilot X Review 2026