Which AI coding agents are patched against Plugin4Shell?

As of September 19, 2026, Anthropic patched Claude Code in version 2.1.179 and OpenAI patched Codex in version 0.146.0. Microsoft has not shipped a fix for GitHub Copilot. Google did not patch Gemini CLI; it deprecated the tool (free, Pro and Ultra access ended June 18, 2026) and directs users to Antigravity, which does not use the vulnerable plugin-pinning system. Any Gemini CLI install still in use remains exposed.

Is Plugin4Shell being exploited in the wild?

No exploitation in the wild has been reported as of September 19, 2026. AIR found the bug in May 2026 with working proof-of-concept exploits against all four agents, disclosed it to vendors in June, and published on September 18. AIR's earlier research shows the prerequisite steps are realistic: a benign plugin it published reached more than 26,000 agents, and its SkillJacking work found 925 in-use skills had been hijacked from their maintainers, reaching 134,000 agents.

How do I protect myself from Plugin4Shell?

Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Turn off background plugin auto-update until you have verified the patch. Prefer marketplaces hosted on GitHub, which rejects 40-hex branch names, over Bitbucket or self-hosted git, which allow them. If you run your own installer or harness, add one assertion after checkout: `test "$(git rev-parse HEAD)" = " " || abort`. Copilot users have no patch yet and should treat marketplace plugins as untrusted; Gemini CLI users should migrate to Antigravity.

Quick Answer

What Is Plugin4Shell? Zero-Click RCE in AI Coding Agents

Q: What is Plugin4Shell?

Plugin4Shell is a supply-chain vulnerability disclosed by AIR Security on September 18, 2026 that affects the plugin systems of four AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. Each agent checks out a marketplace-pinned commit SHA but never verifies that the checkout actually landed on that commit. An attacker who controls a plugin's repository can name a branch after the pinned SHA (or, for Gemini CLI, name the default branch FETCH_HEAD), make it the default, and git will check out the branch instead of the commit. Because Claude Code and Codex auto-update plugins in the background by default, the malicious swap reaches already-installed plugins with no user action, which makes it zero-click remote code execution.

Published: September 19, 2026

The short version

Plugin4Shell is a plugin SHA-pinning bypass in the four most-used AI coding agents — Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI — disclosed by AIR Security on September 18, 2026. The agents check out the exact commit a marketplace pinned but never confirm the checkout landed there. An attacker who controls the plugin’s repository can make git resolve that pin to a branch of malicious code while the pin still looks honoured. Because plugin auto-update runs in the background (the default in Claude Code and Codex), the swap reaches already-installed plugins with no click, no prompt and nothing to notice.

AIR calls it “the first supply chain vulnerability of the AI agent ecosystem.” Previous agent-security research attacked the model or the agent; Plugin4Shell attacks the distribution layer underneath them.

Status by agent (September 19, 2026)

Agent	Vendor	Variant	Fix	Status
Claude Code	Anthropic	Branch named as pinned SHA	Patched in 2.1.179	Update
Codex	OpenAI	Branch named as pinned SHA	Patched in 0.146.0	Update
GitHub Copilot	Microsoft	Branch named as pinned SHA	No patch shipped	Exposed
Gemini CLI	Google	Default branch named `FETCH_HEAD`	Not patched — tool deprecated	Exposed indefinitely; move to Antigravity

AIR found the bug in May 2026, built working proof-of-concept exploits against all four agents, and disclosed to each vendor in June 2026. Three months later two vendors have shipped fixes, one has not, and one retired the product instead.

How the bypass works

SHA pinning is supposed to be the end of the rug-pull problem: review a plugin at one commit, pin that commit, and trust that only that code will ever run. Plugin4Shell shows the pin is written but never enforced.

Variant 1 — the pinned commit becomes a branch (Claude Code, Codex, Copilot)

These agents install a plugin with the equivalent of:

git clone <plugin repo> ./
git checkout aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

The attacker, who controls the upstream repository, creates a branch whose name is the 40-hex pinned SHA and makes it the repository’s default branch. The clone brings that branch down locally. When a name is both a valid ref and an object id, git prefers the ref and only prints a “refname is ambiguous” warning. The working tree is now attacker-controlled, and the agent reports a successful install at the pinned commit.

Two conditions make this work: the host must allow a branch to be named like a hash, and the branch must be the default. GitHub rejects 40-hex branch names outright; Bitbucket and any self-hosted git server allow them, and Anthropic’s own documentation lists both as supported marketplace backends.

Variant 2 — the pin is fetched but never checked out (Gemini CLI)

Gemini CLI pins with --ref in three steps: a shallow clone, git fetch origin <sha>, then git checkout FETCH_HEAD. The fetch retrieves the right commit, but if the repository’s default branch is itself named FETCH_HEAD, the checkout resolves to the branch and silently discards the fetched commit.

The five-step attack

Plant — publish a genuinely benign plugin pinned at commit aaa…. It passes review.
Adoption — users install it, each pinned to the reviewed commit.
Version bump — ship a routine, still-benign update; the marketplace re-pins to bbb….
Rug-pull — create a branch named bbb…, make it the default, point it at malicious code. The real commit can stay untouched.
Auto-update to RCE — the changed pin triggers every agent’s background update; the checkout resolves bbb… to the branch, and it runs.

The attacker does not need to persuade anyone to install anything new. They only need a benign plugin to already be there — and AIR has shown that step is easy: a plugin it built spread to 26,000 agents before being pulled, and its SkillJacking research found 925 skills already in use had been hijacked from their maintainers, reaching 134,000 agents.

Why a marketplace cannot fix this alone

The pin is resolved inside the agent, on the developer’s machine. A marketplace can blunt the branch-name variant by only allowing GitHub-hosted plugins, but that bans backends the agents officially support and does nothing for Gemini CLI’s FETCH_HEAD variant. The only complete fix is one assertion inside the agent after checkout:

test "$(git rev-parse HEAD)" = "<pinned-sha>" || abort

It has to check the resolved HEAD, not the ref that was requested — that distinction is exactly what the Gemini variant slips through.

What to do today

Claude Code: run claude --version; anything below 2.1.179 is vulnerable. Update.
Codex: anything below 0.146.0 is vulnerable. Update.
GitHub Copilot: no patch. Disable or remove marketplace plugins you do not strictly need; treat auto-updates as untrusted until Microsoft ships a fix.
Gemini CLI: Google’s guidance is to migrate to Antigravity, which was built without the plugin-pinning mechanism this attack relies on. Every remaining install stays exposed.
Everyone: turn off background plugin auto-update until you have confirmed your version, prefer GitHub-hosted marketplaces, and if you maintain a plugin, enable branch protection and 2FA on the repository — takeover of the upstream repo is the precondition for both attack paths.

For the broader hardening checklist — pinning, allow-lists, sandboxing and auto-update policy — see the companion guide on securing AI coding agent plugins and skills.