Plugin4Shell: How One Git Trick Exposed a Flaw in Four AI Coding Agents

Security researchers at Air Security have published details of a vulnerability they call Plugin4Shell — a zero-click remote code execution flaw affecting the four most widely used AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI.

The vulnerability requires no action from the victim. An attacker can swap a plugin's reviewed code for malicious code without the developer ever clicking anything. As of September 2026, the patch status across vendors is uneven, leaving millions of developers potentially exposed.

How Plugin4Shell Works

AI coding agents support plugins and extensions that expand their capabilities — connecting to databases, running linters, accessing documentation, and executing custom workflows. These plugins are typically distributed through marketplaces and installed with a degree of trust based on code review and SHA pinning (cryptographic verification that code matches a known hash).

Plugin4Shell exploits a design flaw in how these agents handle plugin updates. By manipulating git references, an attacker can replace a plugin's reviewed code with malicious code while bypassing SHA pinning safety checks. The agent continues to trust the plugin because the pinning mechanism validates against a compromised reference rather than the actual code content.

Air Security built a working proof of concept in May 2026 and disclosed to all four vendors in June. The attack is zero-click: once a developer has installed a compromised plugin, no further interaction is needed for code execution.

Vendor Responses: A Patchwork

Vendor	Product	Status
Anthropic	Claude Code	Fixed in version 2.1.179 (June 2026)
OpenAI	Codex	Fixed in version 0.146.0 (August 2026)
Microsoft	GitHub Copilot	No fix shipped as of September 18
Google	Gemini CLI	Will not fix — product being retired

Anthropic's fix came relatively quickly after disclosure, though the company's release notes for version 2.1.179 do not mention the vulnerability. Air Security's blog post remains the only public account confirming the fix exists.

OpenAI patched Codex in August, verified by researchers on August 12.

Microsoft has not shipped a fix for GitHub Copilot despite nearly four months of notice. Given Copilot's install base across enterprise development teams, this is the most concerning gap.

Google stated on August 4 that no fix would ship for the Gemini CLI, pointing users toward Antigravity as an alternative. Antigravity is not vulnerable because it lacks the plugin pinning mechanism that Plugin4Shell exploits. The open question is how many Gemini CLI installations remain active on developer machines.

The Broader Plugin Supply Chain Problem

Plugin4Shell is not the first supply chain attack targeting AI coding tools. Earlier in 2026, researchers documented a campaign that created a fake marketplace and reached approximately 26,000 agents. The attackers then hijacked 925 skills already in use, affecting 134,000 agents, by taking over the repositories behind them.

These incidents reveal a systemic weakness: AI coding agents are installing and executing code from external sources with insufficient verification. The plugin ecosystem is growing faster than the security infrastructure supporting it.

Traditional software supply chain security — dependency scanning, signed packages, reproducible builds — was developed over decades for package managers like npm and pip. AI coding agent plugins are adopting similar distribution models without adopting similar security maturity.

What Developers Should Do Now

Update immediately. If you use Claude Code, ensure you are on version 2.1.179 or later. If you use Codex, update to 0.146.0 or later.

Audit Copilot installations. With no Microsoft patch available, consider restricting Copilot's plugin and extension capabilities in enterprise environments until a fix ships.

Retire Gemini CLI. If any team members still run Google's Gemini CLI, migrate to Antigravity or another supported tool.

Review installed plugins. Inventory every plugin and extension across your team's AI coding tools. Remove anything not actively needed. Verify that remaining plugins come from trusted sources with intact repository ownership.

Implement network controls. AI coding agents with plugin execution capabilities should operate within network segments that limit their ability to reach sensitive infrastructure, even if a plugin is compromised.

No CVE, No Advisory

As of September 18, 2026, no CVE identifier has been assigned to Plugin4Shell, and no security advisory has been published by any of the four affected vendors. This absence of formal disclosure is itself a problem. Developers relying on CVE databases and vendor security bulletins would have no way to know they are affected.

Air Security's public disclosure appears to be the only source of information about the vulnerability and its fixes. This highlights a gap in how AI tool security incidents are communicated compared to traditional software vulnerabilities.

Implications for AI-Assisted Development

The Plugin4Shell vulnerability arrives during a period of rapid adoption of AI coding agents. Enterprises are integrating these tools into development workflows, CI/CD pipelines, and code review processes. A zero-click RCE in the tools developers use daily is not a theoretical risk — it is an active exposure with incomplete patching.

The incident should prompt organizations to treat AI coding agents with the same security rigor applied to any software with code execution privileges: version management, plugin auditing, network segmentation, and incident response planning.

AI coding tools make developers faster. Plugin4Shell demonstrates they can also make attackers faster — without the developer ever knowing.