Plugin4Shell Hits Four Major AI Coding Agents
2 min readA single flaw in how AI coding assistants handle plugin updates left four of the biggest tools open to silent takeover. Researchers at AIR disclosed it on September 17 and named it Plugin4Shell. Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI were all affected.
What SHA Pinning Was Supposed to Do
AI coding agents lean heavily on plugins: small add-ons that extend what the assistant can do inside a project. To keep those add-ons safe, developers rely on SHA pinning, which locks an installed plugin to one exact, reviewed version of its code. The promise is simple. Once a plugin passes review, it cannot change underneath you without you knowing.
How Plugin4Shell Breaks It
AIR researchers Or Nevo, Dor Granat and Niv Hoffman found that the pin can be bypassed. An attacker who controls a plugin repository can create a branch named FETCH_HEAD, which redirects the checkout to malicious content instead of the commit that was actually fetched. The result is remote code execution with no click, no approval prompt and no reinstall required.
The damage potential comes from inherited permissions. Plugins typically run with the same access as the developer running the agent, which in practice means local source code, cloud credentials, SSH keys, internal repositories and production secrets. AIR reported the bug to all four vendors in June after building working proof-of-concept exploits in May. According to Help Net Security, Anthropic shipped a fix in Claude Code 2.1.179 and OpenAI patched Codex in version 0.146.0. Google said Gemini CLI is deprecated and will not be fixed, pointing users to Antigravity instead. Microsoft had no fix for Copilot at disclosure.
Why It Matters
No exploitation in the wild has been reported, and no breach has been tied to the flaw. What makes it worth attention is that four independently built products shared the same wrong assumption about what a pinned hash guarantees. That points at an ecosystem problem rather than one vendor’s bug.
Developers running any of these agents should check their versions now, and treat an unpatched or deprecated agent as a live credential exposure rather than a scheduling problem. The broader question is whether plugin trust models built for human-reviewed extensions still hold when an autonomous agent is the one installing them.