Plugin4Shell flaw let rogue repos swap code past four AI coding agents' pin checks

Security firm Air Security has disclosed a supply-chain flaw it calls Plugin4Shell, affecting how four major AI coding agents -- Claude Code, OpenAI Codex, GitHub Copilot and the Gemini CLI -- verify plugins they install from a marketplace. The flaw lets a malicious repository owner serve different code than the commit hash an agent believes it pinned.

How the pin check fails

When one of these agents installs a plugin, it checks out a specific 40-character commit hash to guarantee the code matches what was reviewed. The agents did not verify that the resulting working tree actually matched that hash after checkout. That gap let an attacker who controls the plugin's repository create a branch with a name identical to the pinned hash and set it as the repository's default -- causing the agent to install different code while still reporting the correct, locked version. Because plugins run with the same privileges as the user, that substituted code can reach local files, credentials and connected systems. Air Security found the issue in May 2026 and disclosed it to each vendor the following month before publishing on 17 September.

Patch status varies sharply by vendor

Anthropic fixed the issue in Claude Code 2.1.179, and OpenAI fixed it in Codex 0.146.0. Microsoft has not shipped a fix for GitHub Copilot. Google has said it will not fix the Gemini CLI, since the product is being retired in favor of Antigravity. Reporting on the disclosure also notes an important caveat: there is no public evidence of active exploitation in the wild -- the researchers demonstrated working proof-of-concept exploits against all four agents, not observed attacks.

MSP checklist

• Inventory which coding agents and versions are running across client environments, including which ones install marketplace plugins.
• Pin or upgrade to Claude Code 2.1.179 or later, and Codex 0.146.0 or later.
• For Copilot, watch for a vendor fix and restrict or review marketplace plugin installs in the meantime.
• For the Gemini CLI, plan a migration path since Google has stated it will not patch this issue.
• Where policy allows, prefer GitHub-hosted plugin sources -- GitHub rejects the branch names the attack relies on -- and give non-GitHub-hosted plugins closer manual review rather than assuming they are unsafe outright.

The underlying lesson for MSPs is that a pinned commit hash is only as trustworthy as the tool that checks it; treat agent version and plugin-source inventory as a standing control, not a one-time cleanup.

Sources: Air Security, The Hacker News, Help Net Security.