Claude Code, OpenAI Codex CLI, Google Gemini CLI, Microsoft

Plugin4Shell: plugin SHA-pinning bypass gives zero-click code execution via auto-updating plugins (Claude Code, Codex, Gemini CLI, Copilot)

Air published the technical write-up on 17 September and The Register covered it the same day; fixes for Claude Code and Codex exist now, while Gemini CLI has no fix and Copilot is unpatched, so developer machines and CI runners with plugins installed are exposed until upgraded or plugins are removed.

Researchers at Air Security report that major AI coding agents check out a marketplace plugin at its pinned commit SHA but never verify the checkout actually resolved to that commit. An attacker who controls a plugin's repository can make the checkout resolve to malicious code while the pin appears honored; because Claude Code and Codex auto-update installed plugins by default, the malicious version is pulled and executed with no user action, giving the attacker everything the agent can reach (source, credentials, tokens, cloud access). Anthropic and OpenAI have patched; Google says the deprecated Gemini CLI will not be fixed; Microsoft has not responded and Air says Copilot remains vulnerable. GitHub says it blocks branch/tag names that resemble SHAs, but Air notes marketplaces hosted elsewhere (e.g., Bitbucket) are not covered. No CVE has been assigned and there is no report of exploitation.

Affected: Claude Code before 2.1.179; Codex CLI before 0.146.0; all Gemini CLI installs (deprecated, no fix); Microsoft Copilot (unpatched, per Air) — exact Copilot builds not stated

Check versions: `claude --version` (need 2.1.179+), `codex --version` (need 0.146.0+); any Gemini CLI install is affected; Copilot users with marketplace plugins from non-GitHub hosts should assume exposure. List installed plugins and their marketplace source; for each, compare the locally checked-out commit hash against the marketplace's pinned SHA and confirm the repo's branch/tag names do not resemble commit SHAs. Review agent logs for unexpected plugin updates since June.

Upgrade Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Uninstall Gemini CLI and move to a supported tool (Google recommends Antigravity). For Copilot and any agent without a fix, turn off plugin auto-update, remove plugins sourced from non-GitHub marketplaces, and restrict agents to plugins from repositories you control.