Plugin4Shell is a disclosed supply-chain flaw in plugin installation flows for Claude Code, Codex, GitHub Copilot and Gemini CLI: clients requested pinned Git commits but did not verify what code actually landed on disk.

Key takeaways

  • AIR Security says repository control could turn a trusted plugin update into code substitution without a fresh click.
  • Claude Code 2.1.179 and Codex 0.146.0 are listed as fixed; Copilot lacked a shipped fix and Gemini CLI was being retired at disclosure.
  • The durable control is post-checkout identity verification before any plugin discovery, dependency install or execution.

What Plugin4Shell exposed

Plugin4Shell did not break the cryptography behind Git commit hashes. It exposed a simpler implementation error: several coding-agent plugin installers accepted a commit-like value, asked Git to check it out and then failed to confirm that the resulting HEAD was the expected commit. AIR Security reported the same missing postcondition across Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.

That gap matters because Git resolves more than immutable object IDs. References such as branch names can also participate in revision resolution. AIR described a case where an attacker controlling a plugin repository could create a reference that looked like the pinned 40-character hash. If the installer never compared the resolved checkout with the approved object, different code could arrive while the marketplace record still appeared pinned.

Why the route could become zero-click

The initial prerequisite is important: the attacker needs control of a plugin repository or a repository that users already trust. This is not an arbitrary remote takeover of every agent installation. The danger comes after trust has been established. AIR says background plugin updates in Claude Code and Codex could pull the substituted code without a new user action.

Once loaded, plugin code can inherit the permissions available to the coding agent and the user running it. That may include source trees, developer credentials, package tokens, cloud configuration and access to internal systems. The label “zero-click” describes the update path after installation; it does not erase the repository-control and plugin-adoption preconditions.

Patch status was uneven

AIR and independent reports list Claude Code 2.1.179 and Codex 0.146.0 as fixed. The correction is conceptually small but decisive: resolve the requested commit and verify that the checked-out object exactly matches before loading any plugin content.

At disclosure, the reports said Microsoft had not shipped a GitHub Copilot fix. Google reportedly planned no patch for the affected Gemini CLI path because that client was being retired, with migration recommended. Administrators should confirm current vendor guidance directly because patch status can change after a public report. No reviewed source established exploitation in the wild.

Why marketplace review is not enough

A marketplace review answers whether a specific version looked acceptable at review time. A cryptographic pin answers which immutable object was approved. The local installer still has to enforce that decision. If it asks for one object but loads another, neither the review nor the stored hash protects execution.

Host restrictions can reduce exposure. GitHub, for example, rejects some ambiguous reference names used in the reported technique. But client-side verification is the durable boundary because coding-agent ecosystems can support self-hosted Git, Bitbucket or other repositories with different naming rules. A security promise should not silently depend on every supported host making the same policy choice.

What engineering teams should do now

First, inventory coding-agent clients and installed plugins across developer laptops, remote workspaces and CI runners. Record the plugin source, expected commit and last update time. Raise Claude Code and Codex to the fixed floors or later supported builds, and follow current vendor mitigations for Copilot and Gemini CLI.

Second, disable automatic plugin updates where a verified fixed client is not available. Prefer repositories controlled by the organization, and review changes to marketplace pins as supply-chain events. Where possible, fetch by object ID, compare the resolved HEAD with the allowlisted commit, verify a content digest and perform all checks before dependency installation or hooks.

Third, reduce what a successful plugin compromise can reach. Run agents with scoped credentials, separate personal and production identities, limit outbound network access and keep high-value signing keys outside the agent runtime. Log plugin resolution, resolved commit, content digest and execution decisions so incident responders can reconstruct what actually ran.

Detection and historical review

Teams should search for plugin updates from repositories that changed ownership, default branches or hosting backends. Compare cached plugin trees with the commits recorded by the marketplace. Unexpected child processes, credential access, new outbound destinations or modifications outside the workspace deserve review, but none alone proves exploitation.

Do not overstate exposure counts. An installed agent, a marketplace plugin and a vulnerable code path are different populations. The reviewed disclosures did not provide a verified victim count. The defensible question is whether a specific environment installed or refreshed a plugin through an affected flow and whether the resolved bytes matched the approved commit.

The broader lesson

Everyone else is reporting a zero-click flaw; we are explaining the failed invariant. A pin is only metadata until the consumer verifies the resolved artifact. That lesson applies beyond AI agents to package managers, CI actions, infrastructure modules and any updater that translates an approved identifier into executable code.

Plugin4Shell is therefore less about model behavior than software supply-chain discipline. The agent did not need to be persuaded by a prompt. The surrounding installer gave repository-controlled code a path across a trust boundary. Stronger models do not fix that; explicit verification, least privilege and auditable execution do.

Plugin4Shell evidence mapA labelled editorial diagram summarising verified facts and remaining evidence gaps.DISCLOSUREMECHANISMNEXT PROOF2026-09-17Verified factsOperating dataPrimary recordIndependent checksWatchpointPlugin4Shell evidence mapA labelled editorial diagram summarising verified facts and remaining evidence gaps.DISCLOSUREMECHANISMNEXT PROOF2026-09-17Verified factsOperating dataPrimary recordIndependent checksWatchpointPlugin4Shell evidence mapA labelled editorial diagram summarising verified facts and remaining evidence gaps.DISCLOSUREMECHANISMNEXT PROOF2026-09-17Verified factsOperating dataPrimary recordIndependent checksWatchpoint

Facts at a glance

Fact Value Source
Public disclosure 17 September 2026 AIR Security
Affected flows Claude Code, Codex, GitHub Copilot, Gemini CLI AIR Security
Claude Code fixed floor 2.1.179 AIR / independent reports
Codex fixed floor 0.146.0 AIR / independent reports
Copilot status at disclosure No shipped fix reported AIR / independent reports
Known exploitation No confirmed in-the-wild exploitation in reviewed sources Source review

Related Lapaas Voice coverage

FAQs

What is Plugin4Shell?

Plugin4Shell is AIR Security’s name for a Git SHA-pinning bypass reported in plugin flows for four AI coding agents.

Which clients were affected?

AIR named Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI.

Which versions were reported fixed?

Claude Code 2.1.179 or later and Codex 0.146.0 or later were listed as fixed at disclosure.

Was Plugin4Shell exploited in the wild?

The reviewed sources did not confirm in-the-wild exploitation.

What is the key technical control?

Verify the resolved checkout and content against the approved commit before loading or executing any plugin code.

Sources

Get the day’s top stories in your inbox

One concise email. No spam, unsubscribe anytime.