Researchers at Air Security published a vulnerability they call Plugin4Shell on Thursday. It affects the four most widely used AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. The authors, Or Nevo, Dor Granat and Niv Hoffman, describe it as zero-click remote code execution, meaning the victim takes no action at all. The practical consequence is that a plugin a developer already trusts can be replaced with attacker code during a routine background update.
What the attack bypasses
Marketplaces install add-ons for coding agents by pinning each plugin to a commit hash, a 40-character string that identifies one exact snapshot of the code. The snapshot is reviewed once, pinned, and the agent is supposed to run that audited code forever. Air found that the agents request the pinned snapshot but never verify what they actually received. Git allows a branch to carry almost any name, including a string identical to a commit hash, and when a name is both a valid branch and a valid object, git quietly prefers the branch. Whoever controls a plugin repository can therefore create a branch named after the pinned hash, point it at different code and make it the default. The agent checks out the branch, installs the attacker's code and reports a clean install at the pinned commit.
The Gemini CLI fails in a different way. It fetches the correct commit and then runs a checkout that a default branch named FETCH_HEAD can capture, so the correct code never reaches the disk. The fix is one line: after checkout, resolve what actually sits in the working tree and abort unless it matches the pin. Anthropic shipped the fix in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Microsoft has released no fix for Copilot, and Google will not patch the Gemini CLI because it is retiring the product. Air built a working proof of concept in May and disclosed to all four vendors in June; Anthropic confirmed its fix on 17 June, Google said on 4 August that none would ship, and Codex was verified fixed on 12 August.
The attack does not require anyone to install anything new. Agents refresh installed plugins in the background, and Claude Code and Codex do this by default, so the scheme replaces a plugin the developer already runs. Air lays out the sequence: publish something genuinely useful, pass review, gather users, ship a routine update so the marketplace re-pins to a new commit, then create a branch named after that new pin and fill it with malicious code. A plugin runs with the same access as the person using the agent, so the swapped code reaches their files, stored credentials and every system they can log in to. OWASP flagged the same problem this month, moving excessive agency to third place in its 2026 top ten.
What this means for business
GitHub rejects branch names shaped like commit hashes, so the branch trick fails there, and a spokesperson told The Register that this mitigation stops exploitation on GitHub. Air disagrees: marketplaces can sit on Bitbucket or on a company's own git server, both of which allow hash-shaped branch names, and Anthropic's own documentation lists them as valid marketplace backends. Copilot supports those hosts too, which is where Air says the risk sits. Microsoft did not respond to The Register. Roughly 90% of Fortune 500 companies use Copilot, according to Microsoft's own figure, and Copilot is one of the two agents with no patch.
In practice the flaw is narrower than the count of four agents suggests. Swati Khandelwal of The Hacker News checked the marketplaces the agents ship with on 18 September and found that every plugin in Anthropic's community catalogue, and in the default catalogues for Claude Code and Copilot, points to a GitHub repository. Background auto-update, the part that makes the attack zero-click, runs by default only for the agents' own built-in marketplaces, and those live on GitHub; for outside marketplaces it stays off or optional. A developer who installs only from the default catalogues never meets the branch-name version. That reasoning does not cover the Gemini CLI, whose variant relies on a branch named FETCH_HEAD rather than a hash, a name GitHub's rule does not clearly block, and it is the one agent nobody will ever patch.
As of 18 September, The Hacker News found no CVE identifier assigned and no security advisory published by any of the four vendors. Anthropic's release notes for 2.1.179 do not mention the fix, so Air's post is the only public account that it exists, and there is no sign the flaw has been used in a real attack. Four months of silence is a long time for software the Fortune 500 runs, and it sits awkwardly beside the Cyber Resilience Act, which sets a 24-hour reporting deadline for actively exploited vulnerabilities and pushes towards documented software supply chains. Air has worked this seam before: it planted a malicious skill in a marketplace and reached about 26,000 agents, then hijacked 925 skills already in use, affecting 134,000 agents, by taking over the repositories behind them. SHA pinning was the industry's answer to both, and five labs agreed a common plugin standard in August. The same design error appeared in four products from four different companies, which points to an unchecked assumption rather than one team's slip.
One thing the published accounts do not settle: whether updating an affected agent removes a plugin that was already swapped, or only stops the next swap. That question should be put to the vendor directly, together with where the marketplace is hosted and whether auto-update is enabled for anything outside the built-in catalogue. The marker to watch is a CVE identifier or a vendor security advisory for Plugin4Shell: if one appears, the flaw moves from a research finding into a documented supply-chain risk that procurement and security teams will have to account for. Google points Gemini CLI users at Antigravity, which the attack cannot reach because it has no plugin pinning to bypass; how many Gemini CLI installs are still running in a year will show how quickly that migration actually happens.
