Air Security reports that a flaw it calls Plugin4Shell can let an attacker turn a trusted coding-agent plugin into a route to remote code execution. The research firm says the issue affects plugin handling in Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI, and that it disclosed the problem to the vendors before publishing its account.
The reported weakness sits in a safeguard many plugin systems use: pinning an installation to a specific Git commit. Air Security says the affected agents request the pinned identifier but do not verify that the working tree ultimately landed on that exact commit. An attacker who controls a plugin repository could create a branch whose name matches a pinned SHA and make it the default branch. Git can resolve that ambiguous name as a ref instead of the intended object, leaving the agent with attacker-controlled code while the pin appears to have been honored.
Why installed plugins are part of the risk
The attack described by Air Security does not depend on persuading someone to install a new malicious add-on at the moment of compromise. Its researchers say a benign plugin can first pass review and be installed normally; a later update can then be used to swap in malicious code. Because some affected tools update plugins in the background, the firm characterizes the resulting path as zero-click for users who already have the plugin.
Air Security says Anthropic fixed the issue in Claude Code 2.1.179 and OpenAI fixed it in Codex 0.146.0. Its report says Microsoft had not released a Copilot fix at publication, while Google said it would not patch the deprecated Gemini CLI. The proposed durable check is straightforward but important: after checkout, the agent should compare the resolved HEAD commit with the requested SHA and stop if they differ. That verification, the researchers argue, must happen inside the agent because the risky resolution occurs on the client.
