Security researchers at Air Security disclosed a flaw they call "Plugin4Shell" that lets someone who controls a plugin's code repository replace the plugin an AI coding agent installs with malicious code — even when the agent appears to have locked that plugin to a reviewed commit hash. The effect, Air warns, is that a swapped plugin runs with the same access as the person using the agent and can therefore read files, access saved credentials, and use the user's sign-on privileges.
How the Plugin4Shell trick works
Marketplaces for agent add‑ons lock a plugin to a single reviewed version identified by a commit hash. Air found that the four agents fetch the snapshot referenced by that hash but do not verify that the code they end up running actually matches the pinned snapshot. On hosts that permit branch or tag names that look like commit hashes, a repository owner can create a branch with a hash-shaped name and point it at different code. The agent will install that different code while still reporting the locked commit.
Which agents are affected and what fixes exist
Air reported that Anthropic has patched the flaw in Claude Code 2.1.179 and that OpenAI fixed the issue in Codex 0.146.0. Air said GitHub Copilot has no fix, and that Google will not patch the Gemini CLI because it is retiring the consumer CLI. The sources do not say whether updating an affected agent removes a plugin that was already swapped, or only prevents future swaps.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadWhy the vulnerability depends on the git host and the marketplace
The trick does not work on code hosts that forbid branch or tag names that look like commit hashes. GitHub's documentation, Air says, blocks hash‑shaped branch and tag names, so a plugin installed from a GitHub repository is not exposed to the branch‑name technique. Air identified hosts that do allow such names — for example, Bitbucket or an enterprise's own git server — as environments where the attack can succeed, and noted that the agents support installing plugins from those hosts as well as from GitHub.
The Gemini CLI is vulnerable by a different repository trick: Air says its installer can be fooled by a repo whose main branch is named FETCH_HEAD. GitHub's rule against hash‑shaped names does not clearly block the name FETCH_HEAD, so it is not established that installing a Gemini CLI plugin from GitHub avoids the flaw. Google has been retiring the consumer Gemini CLI and directing users to Antigravity, which Air says this attack cannot reach; enterprise updates for Gemini CLI will continue but whether they will include a fix is unclear.
Auto-update, marketplaces, and real‑world exposure
Background auto‑update makes the attack much more dangerous because it lets an agent refresh installed plugins without user action, allowing a trusted plugin to be replaced silently. Air says auto‑update runs by default in Claude Code and Codex. However, auto‑update is on by default only for the agents' own built‑in marketplaces, which the report says are hosted on GitHub; Anthropic's and GitHub's documentation say auto‑update is off or optional for outside marketplaces. The Hacker News checked the agents' marketplaces on September 18 and found that every plugin in Anthropic's community catalog and in the default catalogs for Claude Code and Copilot points to a GitHub repository, a fact that reduces exposure to the branch‑name variant of the attack under Air's and GitHub's account of how it operates.
What this means for technologists, enterprises, and end users
- Technologists and security teams: confirm whether affected agents are updated to the patched versions Air cites (Claude Code 2.1.179, Codex 0.146.0), and evaluate auto‑update settings and the hosts where plugins are sourced — particularly non‑GitHub hosts such as Bitbucket or internal git servers.
- Enterprises and procurement leaders: note that the fix must ship in the agent itself because each agent checks the lock on the user's machine, not at the marketplace; marketplaces therefore cannot unilaterally protect their users from this flaw.
- End users: be aware that a plugin swapped by this technique inherits your agent's access and that, according to Air, a background auto‑update can make a swap invisible to the user if it runs by default.
Air told the vendors in June and, as of September 18, no CVE identifier had been assigned and none of the four vendors had published a security advisory for the flaw, checks by The Hacker News found. The Hacker News also reproduced the underlying Git behavior in a local test, and OpenAI's public fix describes the same bug: Git "can interpret a requested commit SHA as a branch name," which can make a plugin source "materialize a different commit than the one it pinned." The June finding that a fake skill could reach roughly 26,000 agents by changing a cleared external link is the immediate precedent Air cites; Plugin4Shell moves the attack from a swapped link to a swapped plugin sitting behind a version lock.
The concrete questions left on the record are whether vendors will assign CVEs and publish advisories, whether updates will roll back already swapped plugins, and how many real‑world installations use non‑GitHub hosts or default auto‑update settings that would make them vulnerable. Those answers will determine whether Plugin4Shell remains a theoretical research demonstration or a practical avenue for compromise.
