Security firm Air Security has published details of a flaw — dubbed Plugin4Shell — affecting four widely-used AI coding agents: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI. The flaw lets someone who controls a plugin’s code repository silently swap the plugin’s contents for malicious code, even when the agent has locked that plugin to a specific reviewed version using a commit hash. Because plugins run with the full permissions of the developer using the agent, swapped code can read files, access saved credentials, and reach any connected system.
The core issue is that these agents fetch a plugin snapshot by commit hash but never verify that the code they receive actually matches it. On Git hosting platforms that allow branch names to resemble commit hashes — such as Bitbucket or self-hosted Git servers — a repository owner can create a branch whose name looks like the pinned hash, pointed at different code. The agent installs that different code while reporting it is on the approved version. GitHub’s rules block hash-shaped branch names, so plugins hosted on GitHub are not directly exposed to this variant of the attack.
A separate path targets the Gemini CLI: a branch named FETCH_HEAD can trigger the same outcome, and GitHub’s restrictions do not clearly block that specific name. Google has stated it will not patch the Gemini CLI, which it is retiring in favor of its newer Antigravity agent. The attack is most dangerous when auto-update is enabled, which allows plugins to be refreshed silently in the background; Claude Code and Codex enable auto-update by default for their built-in marketplaces, which are GitHub-hosted. Plugins sourced from outside those marketplaces are where the risk concentrates.
Air reports it built a working test exploit against all four agents in May, notified vendors in June, and as of today no CVE has been assigned and no vendor has published a security advisory.
How to check if you’re affected
Affected versions:
- Claude Code before 2.1.179 — update with
npm update -g @anthropic-ai/claude-code - Codex before 0.146.0 — update via your package manager
- GitHub Copilot — no fix available; limit plugin sources to the default GitHub-hosted marketplace where hash-shaped branch names are blocked
- Gemini CLI — will not be patched; migrate to the Antigravity agent
If you have installed AI coding agent plugins from Bitbucket or a self-hosted Git server, audit those plugins to confirm their code matches the version you reviewed.