Plugin4Shell Flaw Lets Repo Owners Bypass Version Locks in Four AI Coding Agents

Security researchers have uncovered a vulnerability affecting four widely used AI coding agents that allows anyone who controls a plugin's code repository to swap the plugin an agent installs for a malicious version, even when the agent has locked that plugin to a specific reviewed commit. The flaw, dubbed Plugin4Shell, was disclosed Thursday by Air Security, a startup focused on protecting enterprise AI agents.

In a report authored by Air researchers Or Nevo, Dor Granat, and Niv Hoffman, the firm described the issue as a "plugin SHA-pinning bypass" that results in zero-click remote code execution. Because a plugin runs with the same privileges as the person using the agent, the swapped code can access that person's files, saved credentials, and any systems they can log in to, according to Air.

The affected products are Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. Anthropic has patched the flaw in Claude Code 2.1.179, and OpenAI shipped a fix in Codex 0.146.0. GitHub Copilot has no fix, and Google has said it will not patch the Gemini CLI because it is retiring the product, Air said.

The vulnerability stems from how these agents enforce a marketplace's version-locking mechanism. Marketplaces typically pin each plugin to a single reviewed version using its commit hash, a long string that identifies an exact snapshot of the code. The agents fetch that snapshot but never verify that the code they actually end up with matches the hash they were supposed to retrieve.

On code-hosting platforms that allow branch names to be crafted to resemble commit hashes, a repository owner can point that misleading name at entirely different code. The agent then installs the different code while still reporting that it is running the locked version. Air said it built a working test attack against all four agents in May and notified the vendors in June.

OpenAI's own public fix describes the same underlying bug. Git "can interpret a requested commit SHA as a branch name," the company wrote, which can make a plugin source "materialize a different commit than the one it pinned." That change shipped in Codex 0.146.0.

Where the attack works

The branch-name trick does not work everywhere. GitHub does not allow branch or tag names that resemble commit hashes, according to the platform's documentation, so a plugin installed from a GitHub repository is not exposed to this particular vector. Air said the trick works on hosts that permit such names, such as Bitbucket or a company's own internal git server, which these agents also support.

The Hacker News checked the marketplaces the agents ship with on September 18 and found that every plugin in Anthropic's community catalog, and in the default catalogs for Claude Code and Copilot, points to a GitHub repository. This means users who install plugins only from the agents' default, GitHub-based marketplaces are not exposed to the branch-name version of the attack, based on Air's and GitHub's own accounts of how it works.

However, the Gemini CLI is attacked through a different route. Air said its installer can be tricked by a repository whose main branch is named FETCH_HEAD, and GitHub's rule against hash-shaped names does not clearly block that name. So it is not established that installing a Gemini CLI plugin from GitHub avoids the flaw, and the Gemini CLI is the agent Air says will not be fixed.

Microsoft did not fix the flaw in Copilot, and a GitHub spokesperson told The Register that Plugin4Shell attacks do not affect GitHub itself. "To prevent abuse of SHAs, GitHub does not allow users to create branch or tag names that resemble commit SHAs," the spokesperson said. "This mitigation ensures the reported vulnerability cannot be exploited on GitHub."

Air's researchers pushed back on that characterization. The GitHub mitigation is not sufficient to defeat Plugin4Shell attacks "because marketplaces can also be hosted in other platforms such as Bitbucket," the team told The Register. "Microsoft Copilot is also still vulnerable because it supports marketplaces from such platforms as well, which exposes it to the vulnerability."

Air said it reported the issue to Microsoft in June but received no response. "Unfortunately due [to] the amount of disclosure volume they're currently getting we didn't get a response from them," the researchers said. Microsoft did not immediately respond to The Register's request for .

Auto-update makes it zero-click

What makes the attack require no action from the victim is background auto-update, which lets an agent refresh installed plugins on its own. A plugin someone already trusts can be replaced without any prompt. Air said this runs by default in Claude Code and Codex.

But auto-update is on by default only for the agents' own built-in marketplaces, which are hosted on GitHub, and is off or optional for outside ones, according to Anthropic's and GitHub's documentation. So the zero-click exposure is concentrated in the default marketplace configuration, while the branch-name attack vector requires a non-GitHub source.

Air outlined two attack scenarios. In the first, an attacker submits a benign plugin to a trusted marketplace, the plugin passes review, and then the attacker later replaces the benign content with malicious code. The second involves hijacking a legitimate author's repository and then pushing a malicious version onto every agent that has it installed, essentially bypassing the SHA-pinning safety mechanism that exists to stop this type of supply chain attack. The team demonstrated this type of takeover in its earlier SkillJacking and RepoJacking proof-of-concept attacks.

"Together, the chain is proven end to end - takeovers happen at scale, and Plugin4Shell defeats the mechanism built to contain them," the researchers wrote.

Vendor responses and remediation status

The remediation picture is uneven across the four products. Anthropic's release notes for Claude Code 2.1.179 do not mention the fix, and the account that it is fixed comes from Air. For Copilot, no fix has shipped. Google stopped serving the consumer Gemini CLI in June and has been directing users to Antigravity, its newer agent, which Air said this attack cannot reach. Google has also said that enterprise access to the Gemini CLI will continue with updates, but whether a fix for this flaw is among them is not clear.

Because each agent checks the lock on the user's own machine rather than at the marketplace, no marketplace can fix this for users. The fix has to ship in the agent itself. Air emphasized this point: "The fix has to ship in the agent, and updating is the only complete mitigation where one exists."

As of September 18, no CVE identifier had been assigned, and none of the four vendors had published a security advisory for the flaw, according to checks by The Hacker News. There is no sign the vulnerability has been used in a real attack. The sources do not say whether updating an affected agent removes a plugin that was already swapped, or only stops future swaps.

Air's research builds on earlier work. In June, The Hacker News covered the firm's test in which a fake skill passed security scanners and reached 26,000 agents by changing an external link after the review had cleared it. Plugin4Shell moves that idea from a swapped link to a swapped plugin sitting behind a version lock.

The researchers described the exploit as a "first-of-its-kind AI supply-chain attack" that targets trusted marketplaces rather than the model or agent itself. Such attacks could reach millions of users and machines, they said. Nearly 90 percent of Fortune 500 companies use Copilot, according to Microsoft, which is also one of the two vendors that has not shipped a patch.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.