A vulnerability called Plugin4Shell, disclosed on September 17, 2026 by security research firm AIR, lets anyone who controls a plugin’s source repository swap out the code an AI coding agent already trusted, even when that agent pinned the plugin to a specific, reviewed commit. It affects four major agents: Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. Anthropic and OpenAI shipped fixes before the public disclosure. GitHub and Google have not.
How Plugin4Shell Actually Works
The bug lives in how these agents verify plugin updates. When a plugin is pinned to a commit hash, the agent is supposed to check out exactly that commit and nothing else. According to AIR’s research, none of the four agents actually confirmed the checkout landed where it was supposed to.
That gap is exploitable in a fairly simple way. An attacker publishes a legitimate-looking plugin pinned to a real commit. Once it’s installed and trusted, they push a routine update, and the marketplace re-pins to a new commit hash. The attacker then creates a branch named identically to that 40-character hash and sets it as the repository’s default branch. Because git prefers a matching branch reference over a bare commit reference, the next background auto-update pulls the attacker’s branch instead of the commit that was actually reviewed. No approval prompt, no reinstall, no click required.
AIR summed up why this one stings more than a typical supply chain bug: it “reaches people who already did everything right,” meaning developers who reviewed a plugin, pinned it deliberately, and still ended up running someone else’s code.
Who’s Patched and Who Isn’t
Patch status as of this week, per AIR’s writeup and independent reporting from The Hacker News and Help Net Security:
- Claude Code: patched in version 2.1.179, though Anthropic’s public release notes don’t call out the security fix directly.
- OpenAI Codex: patched in version 0.146.0.
- GitHub Copilot: Microsoft says a mitigation is in place, but researchers dispute that it closes the full attack surface. No dedicated patch has shipped.
- Gemini CLI: deprecated by Google, with no fix coming. Users are being pointed toward a replacement product instead.
AIR’s disclosure timeline runs back further than the public reporting suggests: the flaw was found with a working proof of concept in May 2026 and disclosed to all four vendors in June, giving everyone months of lead time before going public in September. Researchers reported no evidence of in-the-wild exploitation at disclosure.
What This Means If Your Team Uses These Tools
If your developers run Claude Code or Codex, updating to the patched versions above closes this specific hole. If anyone on the team relies on GitHub Copilot’s plugin ecosystem or is still running Gemini CLI, treat plugin auto-updates as an open risk for now rather than an assumption you can rely on, and review what plugins are actually installed rather than trusting that a pinned commit means what it used to.
The broader lesson is one we bring up with clients doing AI development work generally: pinning a dependency to a commit hash or version number only protects you if the tool actually verifies the checkout matches. That’s true well beyond AI coding agents, and it’s worth a second look at any internal tooling that auto-updates plugins or packages in the background without a human checking what changed.
