Plugin4Shell flaw lets repos swap pinned AI agent plugins

A security flaw that the firm Air Security calls Plugin4Shell lets whoever controls a plugin's code repository swap the plugin an AI coding agent installs for a malicious one, even when the agent has locked that plugin to a specific reviewed version. An AI coding agent is a program that writes and edits software code for a user with the help of artificial intelligence. Air Security described the flaw on Thursday and said it affects four widely used agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI.

These agents install add-ons called plugins, which are downloaded from online marketplaces. To keep users safe, a marketplace locks each plugin to a single reviewed version by its commit hash, a long string of characters that identifies an exact snapshot of the code. Air Security found that the agents fetch that snapshot but never check that the code they end up with actually matches it.

A branch is a named line of code inside a repository. On a code host that allows someone to create a branch whose name is made to look like the commit hash, the owner of a plugin's repository can point that name at different code. The agent then installs the different code while still reporting that it is on the locked version. Because a plugin runs with the same access as the person using the agent, the swapped code can reach that person's files, saved credentials and the systems they can log in to, Air Security said.

The trick does not work everywhere. GitHub does not allow branch or tag names that look like commit hashes, according to GitHub's documentation, so a plugin installed from a GitHub repository is not exposed to this branch trick. Air Security says the trick works on hosts that permit such names, such as Bitbucket or a company's own git server, which these agents also support. The Hacker News checked the marketplaces the agents ship with on September 18 and found that every plugin in Anthropic's community catalog, and in the default catalogs for Claude Code and Copilot, points to a GitHub repository.

The Gemini CLI is attacked in a different way. Instead of a branch shaped like the hash, Air Security says its installer can be tricked by a repository whose main branch is named FETCH_HEAD, and GitHub's rule against hash-shaped names does not clearly block that name. So it is not established that installing a Gemini CLI plugin from GitHub avoids the flaw, and the Gemini CLI is the agent Air Security says will not be fixed.

What would make the attack need no action from the victim is background auto-update, which lets an agent refresh installed plugins on its own, so a plugin someone already trusts can be replaced without a prompt. Air Security says this runs by default in Claude Code and Codex. But auto-update is on by default only for the agents' own built-in marketplaces, which are hosted on GitHub, and is off or optional for outside ones, according to Anthropic's and GitHub's documentation. So a reader who installs plugins only from the agents' default, GitHub-based marketplaces is not exposed to the branch-name version of the attack, on Air Security's and GitHub's own account of how it works.

Where each agent stands, according to Air Security: Claude Code is fixed in version 2.1.179, so users should update to 2.1.179 or later; Codex is fixed in version 0.146.0, so users should update to 0.146.0 or later; GitHub Copilot has no fix, and no patch is available; and Google will not patch the Gemini CLI, which it is retiring, with Air Security and Google both pointing users to Antigravity, the newer agent that Air Security says this attack cannot reach. For Copilot, Air Security says it told Microsoft in June and that no fix has shipped. Copilot can install plugins from hosts other than GitHub, which is where Air Security says the risk sits. Google stopped serving the consumer Gemini CLI in June and has been pointing users to Antigravity. Google has also said that enterprise access to the Gemini CLI will continue with updates, and whether a fix for this flaw is among them is not clear.

Air Security says it built a working test attack against all four agents in May and told the vendors in June. As of September 18, no CVE identifier had been assigned, and none of the four vendors had published a security advisory for the flaw, checks by The Hacker News found, and there is no sign it has been used in a real attack. The Hacker News reproduced the underlying Git behavior in a local test, and OpenAI's own public fix describes the same bug: Git "can interpret a requested commit SHA as a branch name," the company wrote, which can make a plugin source "materialize a different commit than the one it pinned." That change shipped in Codex 0.146.0. Anthropic's release notes for 2.1.179 do not mention the fix, and the account that it is fixed in is Air Security's.

Because each agent checks the lock on the user's own machine, not at the marketplace, no marketplace can fix this for users, and the fix has to ship in the agent itself. One thing the sources do not say is whether updating an affected agent removes a plugin that was already swapped, or only stops future swaps. Anyone who ran one of these agents before updating therefore cannot tell from the public record whether cleaning up is enough.

This is not the first time the same researchers have probed agent add-ons. In June, The Hacker News covered Air Security's test in which a fake skill passed security scanners and reached about 26,000 agents by changing an external link after the review had cleared it. Plugin4Shell moves that idea from a swapped link to a swapped plugin sitting behind a version lock.

For teams that let developers run coding agents on work machines, the practical question is where plugin code comes from and who reviews it, which is squarely the kind of work covered by AEU-I, our security-first IT and infrastructure consulting service, where teams can get help reviewing how developer tools are set up and what they are allowed to reach.

Until the situation is clearer, the useful steps are limited but real: update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later, keep plugin installs inside the agent's own built-in marketplace, and avoid plugins offered from other code hosts. Copilot users have no patch to install, and Gemini CLI users are being moved to Antigravity by Google, with Air Security saying that attack cannot reach it.