An attacker doesn’t need you to click anything, download anything, or open a phishing email. All it takes is a branch name that looks like a commit hash. That’s the core of the Plugin4Shell vulnerability, recently disclosed by security researchers at Air Security. It affects the four most widely used AI coding agents in the world: Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. The flaw enables what the researchers call “zero-click remote code execution” — malicious code lands on a developer’s machine automatically, without the developer installing anything new.
Table of Contents
- The Plugin4Shell vulnerability affects Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI through automatic background plugin updates.
- The attack uses branch names that look like commit hashes to bypass SHA-pinning protection; GitHub blocks this, but Bitbucket and self-hosted Git servers don’t.
- Claude Code (version 2.1.179) and Codex (version 0.146.0) are already patched; GitHub Copilot has no fix yet, and Google will not fix Gemini CLI at all.
- In Air Security’s tests, a single malicious skill reached around 26,000 agents; a takeover of already-used skills affected 134,000 agents.
- So far there is no CVE number, no official security advisory, and no evidence of active exploitation — but action is still needed immediately.
What Is the Plugin4Shell Vulnerability?
The Plugin4Shell vulnerability was discovered by Air Security researchers Nevo, Dor Granat, and Niv Hoffman and disclosed in September 2026 [1]. It undermines a core principle all four AI coding agents rely on: plugins and skills are secured via SHA-pinning. That means an installed plugin is bound to a fixed code fingerprint so nobody can secretly swap its contents.
We put the broader risks of autonomous AI coding agents in context in our article AI Security Debate: The OpenAI Breach, Amodei’s Warning, and the Risks of Autonomous AI Agents.
That protection turns out to be bypassable. Claude Code and Codex update plugins automatically in the background by default [2]. These automatic updates are convenient, since developers don’t have to keep chasing new versions manually. But they also open a door: if the update mechanism can be fooled, the agent replaces a known, trusted plugin with malicious code — without the developer ever initiating a new installation. That’s exactly what makes the attack so dangerous. It isn’t a classic malware-download scenario; it’s a silent swap happening in the background [3].
Which AI Coding Agents Are Affected by Plugin4Shell?
The reach of the Plugin4Shell vulnerability is unusually large because it doesn’t hit a single product — it hits four of the most important tools in everyday professional software development [4]. The table below shows the current status (September 21, 2026):
| Agent | Vendor | Patch Status | Version |
|---|---|---|---|
| Claude Code | Anthropic | Patched (confirmed June 17) | 2.1.179 |
| Codex | OpenAI | Patched (verified August 12) | 0.146.0 |
| GitHub Copilot | Microsoft | No fix published | — |
| Gemini CLI | Will not be fixed, product being retired | — |
Google justifies the missing fix by pointing out that Gemini CLI is being discontinued. Users are instead directed to the successor product “Antigravity,” which Google says is not susceptible to this type of attack because it has no plugin-pinning mechanism to bypass in the first place [5]. For Microsoft and GitHub Copilot, the situation remains unresolved: as of September 18, no patch had been published.
How Does the Attack Work Technically?
The actual trick behind the Plugin4Shell vulnerability lies in a small but highly effective gap in version verification. Plugins are normally identified via a commit hash, a unique string marking the exact code state. The problem arises when a Git branch is named so that it looks like such a hash [6].
GitHub prevents this: the platform rejects branch names that look too similar to a commit hash. That’s exactly why the attack doesn’t work on GitHub-based marketplaces. It’s a different story on Bitbucket or on self-hosted Git servers, which many plugin marketplaces rely on. There, hash-shaped branch names are allowed [7]. That’s enough to make an agent believe, during an automatic update, that it’s fetching the exact, verified, unchanged version — while in reality it fetches something else.
“An already-trusted plugin can be replaced with malicious code without the developer ever installing anything new.”
Important context: no further official technical details about the exact exploit procedure have been published. The researchers publicly described the core weakness but deliberately withheld a complete attack blueprint [8].
Scope and Risk of the Plugin4Shell Vulnerability
To demonstrate the scale of the problem, Air Security ran its own tests. A single malicious skill placed on a marketplace reached around 26,000 agents in simulation [9]. A takeover of skills already in active use — 925 skills specifically — affected as many as 134,000 agents [1].
These numbers illustrate why security researchers classify the case as highly critical. A single successful attack on a popular plugin can spread like wildfire across thousands of developer environments, with zero action required from those affected.
Here’s what’s known so far, for context:
- No official CVE number has been assigned yet (as of September 18, 2026).
- None of the four vendors has published a formal security advisory.
- There is no indication that the flaw has already been actively exploited in the wild [2].
That doesn’t mean the all-clear has been given. It means the risk is currently proven in theory but not yet publicly confirmed as an active wave of attacks. Air Security had already built a working proof-of-concept in May 2026 and confidentially reported its findings to all four vendors in June [3]. Several months of coordinated disclosure passed between discovery and public announcement.
Patch Status in Detail: Who Responded, Who Didn’t
Vendor response speed varied significantly. Anthropic reacted fastest, confirming the fix in Claude Code version 2.1.179 on June 17 [4]. OpenAI followed with Codex 0.146.0, verified on August 12 [5]. Both companies responded within a few weeks of the confidential disclosure.
Microsoft is a different story. To date, no published fix exists for GitHub Copilot. That’s notable, since GitHub itself already structurally blocks part of the problem by rejecting hash-like branch names — but the vulnerability in Copilot’s own update mechanism remains untouched by that [6].
Google is taking a third path: instead of patching, Gemini CLI is being discontinued entirely. Users are told to switch to “Antigravity,” a product Google says is architecturally different and has no plugin-pinning to bypass [7]. Whether this migration is practical for all existing Gemini CLI users remains an open question.
One important point remains unresolved according to the reports so far: it’s unclear whether an update to an affected agent automatically removes an already-swapped malicious plugin, or whether it merely prevents future attacks while leaving already-compromised installations uncleaned [8]. That’s especially relevant for teams that were already using plugins before the patch date.
As an industry-wide response to similar past incidents, vendors had already agreed in August 2026 on a shared plugin standard using SHA-pinning [9]. The Plugin4Shell vulnerability now shows that even this standard leaves a bypass open via non-GitHub marketplaces when implementation details aren’t uniformly and strictly enforced [10].
What Developers Should Do Now
Anyone running Claude Code, Codex, GitHub Copilot, or Gemini CLI in production should not delay these steps:
- Update immediately. Bring Claude Code to version 2.1.179 or newer, and Codex to 0.146.0 or newer. Both fixes are already available.
- Review automatic updates — don’t disable them. Automatic updating is generally a good idea, but only with a current, patched version of the agent itself.
- Audit plugin origins. Plugins and skills sourced from Bitbucket or self-hosted Git servers deserve particular scrutiny, since that’s where the real risk sits.
- Treat GitHub Copilot with caution. As long as Microsoft hasn’t published an official fix, teams should manually review and critically check plugin installations and updates in Copilot.
- Plan your Gemini CLI migration. Since Google isn’t shipping a patch, switching to Antigravity or another securely maintained tool is advisable.
- Document your marketplace sources. Security teams within organizations should maintain a list of all plugin sources in use and regularly cross-check it against known advisories.
- Watch for official security advisories. Since there’s no CVE number and no formal advisory yet, it’s worth closely monitoring vendor communication channels in the coming weeks.
These measures don’t replace a comprehensive security strategy, but they substantially reduce the immediate risk — especially for teams running AI coding agents in production environments with access to sensitive systems. If you’re running these agents against your own backend APIs, also read our article REST API Design for Advanced Developers, particularly the sections on input validation and authentication.
Conclusion
The Plugin4Shell vulnerability is a wake-up call for the entire AI-assisted software development industry. It shows that convenience features like automatic plugin updates, without airtight safeguards, can turn into a massive attack surface — with zero active involvement from users. The good news: working patches already exist for two of the four affected agents. The bad news: GitHub Copilot remains unpatched for now, and Gemini CLI users have to migrate entirely.
Even though there’s no known active exploitation in the wild so far, developers and security teams should take this seriously. Patch now, audit your plugin sources, and critically question marketplace origins — these are the three most important steps to protect yourself against the Plugin4Shell vulnerability until every vendor has caught up.
Frequently Asked Questions
nWhich AI coding agents are affected by Plugin4Shell?
nPlugin4Shell affects Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI through automatic background plugin updates.
nHow does the Plugin4Shell attack bypass security protections?
nThe attack uses branch names that look like commit hashes to bypass SHA-pinning protection; GitHub blocks this technique, but Bitbucket and self-hosted Git servers do not.
nWhich tools have been patched against Plugin4Shell?
nClaude Code (version 2.1.179) and Codex (version 0.146.0) are already patched; GitHub Copilot has no fix yet, and Google will not fix Gemini CLI at all.
nHow many agents were affected in Air Security tests?
nIn Air Security tests, a single malicious skill reached around 26,000 agents, and a takeover of already-used skills affected 134,000 agents.
nReferences
[1] theregister – https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335 [2] Plugin4shell Ai Coding Agents Vulnerability – https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/ [3] Plugin4shell Lets Repository Owners – https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html [4] 0lt0 – https://www.swisscybersecurity.net/Blog/0lt0 [5] Ai Tech Plugin4shell Rce Coding Agents – https://allatra.media/news/ai-tech-plugin4shell-rce-coding-agents [6] Plugin4shell Claude Code Codex Copilot Plugins Luecke 2026 – https://skill-sprinters.de/blog/news/plugin4shell-claude-code-codex-copilot-plugins-luecke-2026/ [7] Plugin4shell Coding Agents Rce – https://byteiota.com/plugin4shell-coding-agents-rce/ [8] Air Discloses Plugin4shell Zero Click Rce In Ai Coding Agents – https://aiweekly.co/alerts/air-discloses-plugin4shell-zero-click-rce-in-ai-coding-agents [9] Plugin4shell Vulnerability Breaks A Core Safety Promise In Ai Coding Agents – https://www.remio.ai/post/plugin4shell-vulnerability-breaks-a-core-safety-promise-in-ai-coding-agents [10] Alt Ciso Briefing 2026 09 19 – https://labs.cloudsecurityalliance.org/research/alt-ciso-briefing-2026-09-19/
