Security researchers at Air Security say they found a flaw in the way four AI coding agents install plugins: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. A plugin could appear to be locked to a reviewed version while the agent actually installs different code from the plugin's repository. Air published its findings Sept. 17 and says it disclosed the issue to the vendors in June.
The distinction matters because plugins can run with access to a developer's files and credentials. Air calls the vulnerability Plugin4Shell and says an attacker who controls a plugin's repository could turn a previously trusted add-on malicious. If the agent updates that plugin in the background, an existing user would not need to click through a new installation for the swapped code to arrive.
The pinning safeguard has limits
Plugin marketplaces can identify a reviewed version of code by its commit hash, often called a SHA. According to Air's technical account, the affected agents requested that version from Git but did not verify that the code checked out afterward matched the pinned commit. For Claude Code, Codex and Copilot, Air describes an attack using a branch named to look like the hash. Gemini CLI has a different variation involving a branch named FETCH_HEAD.
That does not mean every installed plugin was at risk. The attacker must control the plugin's repository, and the hash-shaped branch technique requires a Git host that permits such branch names. GitHub blocks them. The Hacker News found that the default Claude Code and Copilot plugin catalogs it checked pointed to GitHub repositories, a meaningful limit on that attack path. The Gemini CLI variation has a different set of conditions.
Air says Anthropic fixed the issue in Claude Code 2.1.179 and OpenAI fixed it in Codex 0.146.0. As of its disclosure, Air said GitHub Copilot had no patch and Google did not plan to patch Gemini CLI. Those are the researcher's reported vendor statuses, not evidence that every current installation remains vulnerable. The Hacker News said on Sept. 18 it had found no sign of the flaw being exploited in a real attack.
