If you use an AI coding assistant like Claude Code, Codex, GitHub Copilot, or Gemini CLI, there’s a security story from this week worth actually reading past the headline. It’s called Plugin4Shell, and what makes it interesting isn’t just that it’s a bug — it’s that four completely separate companies built the same blind spot into their products without knowing it.
Security researchers at a firm called AIR — Or Nevo, Dor Granat, and Niv Hoffman — disclosed the vulnerability on September 17, 2026. In their own words, it’s the first supply-chain-style vulnerability to hit the AI coding agent ecosystem, and after reading through how it works, I think that description holds up.
Here’s the short version. Most of these coding agents let you install plugins from a marketplace — little add-ons that extend what the tool can do. To keep that safe, the marketplace pins each plugin to a specific, reviewed commit hash in its source repository. That pinning is supposed to guarantee that once a plugin passes review, it can’t quietly change underneath you. It’s the same idea as checksums on a software download, just applied to Git.
Plugin4Shell breaks that guarantee. Researchers found that in Claude Code, Codex, and GitHub Copilot, an attacker can create a Git branch whose name happens to match the plugin’s 40-character commit hash. Because of how Git resolves references, it can end up prioritizing that branch name over the actual pinned commit during checkout. If the attacker’s branch contains malicious code, the agent installs it — while still reporting that the install matched the expected, trusted hash. Gemini CLI has its own version of the same problem, tied to how it resolves FETCH_HEAD during its plugin update process, according to the researchers’ public write-up.
The part that turns this from “bad” into “zero-click” is that Claude Code and Codex both auto-update installed plugins in the background by default. So you don’t need to be tricked into installing anything new. If you already have a plugin installed from a marketplace you trust — a plugin that was reviewed properly and pinned exactly the way the security model intends — you can still end up running malicious code the next time it auto-updates, without clicking or approving anything. As AIR put it plainly in their disclosure, “doing the right thing does not protect you.”
That’s worth sitting with for a second, because it’s not the usual “don’t click suspicious links” advice. This is a case where following every recommended best practice still leaves you exposed, because the flaw sits in how the agent verifies what it installed, not in anything the user did.
Who’s fixed it, and who hasn’t
This is where the story gets a bit uneven, and honestly, that unevenness is the more interesting part to me.
Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in version 0.146.0. Both of those fixes reportedly landed before the public disclosure, per Startup Fortune’s reporting, which is the outcome you’d hope for from responsible disclosure.
Google’s response was different. Instead of patching Gemini CLI, the company deprecated it entirely and is directing users toward a separate tool called Antigravity CLI, according to Help Net Security. Practical for Google, less convenient if you’re a developer who’d built workflows around Gemini CLI specifically.
Microsoft’s GitHub Copilot is the one still sitting exposed as of this writing. GitHub has said a platform-level mitigation exists, largely around naming restrictions on GitHub-hosted repositories, but researchers dispute how far that actually covers the problem — plugin marketplaces hosted elsewhere, like Bitbucket, reportedly remain in scope even with that mitigation in place, based on reporting from daily.dev. So there are effectively two different claims being made here, and they don’t fully agree with each other, which is exactly the kind of ambiguity you don’t want in a security disclosure.
To be fair to everyone involved, AIR says it found no evidence of active exploitation in the wild, and no CVE had been assigned as of this writing. This is a disclosed vulnerability, not a confirmed breach — a distinction that matters, even if it’s easy to lose in a headline.
Why this matters beyond the four tools named
What actually stuck with me reading through the disclosures wasn’t the specific Git quirk — that’s a fairly technical detail most people won’t need to understand deeply. It’s that this same design assumption showed up independently in four unrelated codebases. Nobody copied anyone’s mistake. Four different engineering teams, building four different products, all trusted the same thing: that a pinned commit hash, once verified at install time, stays trustworthy afterward.
That’s the actual lesson here, and it’s bigger than any one company’s patch notes. AI coding agents run with real permissions — access to your source code, cloud credentials, SSH keys, internal repositories, sometimes production systems. A plugin ecosystem built on top of that access is only as safe as its weakest verification step, and this disclosure is a pretty clean demonstration of how a reasonable-looking safeguard can still have a gap nobody noticed until someone went looking.
If you’re using any of these four tools with plugins installed, the practical advice is simple. If you’re on Claude Code or Codex, check your version number and update if you’re behind 2.1.179 or 0.146.0 respectively. If you’re on Gemini CLI, it’s worth planning a move to whatever Google’s pointing you toward now, since a fix isn’t coming. And if you’re on GitHub Copilot with plugins from outside GitHub’s own hosting, it’s reasonable to be a little more cautious until there’s a clearer, unified answer on what’s actually covered.
None of this means AI coding agents are unsafe to use in general — millions of developers use them daily without incident, and this flaw was found by researchers doing exactly the kind of proactive testing that’s supposed to catch this before it becomes a real-world problem. But it’s a good reminder that the tools writing our code are themselves software, with their own supply chains, and those supply chains deserve the same scrutiny we’d give any other piece of infrastructure sitting that close to our credentials.
FAQ
What is Plugin4Shell? Plugin4Shell is a zero-click remote code execution vulnerability disclosed on September 17, 2026, by security researchers at AIR. It affects how AI coding agents verify pinned plugin versions, allowing an attacker to bypass commit-hash verification and install malicious code without any user interaction.
Which AI coding tools are affected? Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI are all affected, based on the researchers’ disclosure and confirmation from multiple security outlets.
Is Claude Code safe to use now? Anthropic patched the issue in Claude Code version 2.1.179. Users on that version or later are protected against this specific flaw.
Is GitHub Copilot still vulnerable? As of this writing, Microsoft had not released a dedicated client-side patch for GitHub Copilot. GitHub says a platform-level mitigation exists, though researchers say it may not cover plugin marketplaces hosted outside GitHub itself.
Why did Google deprecate Gemini CLI instead of patching it? Google chose not to patch the vulnerability in Gemini CLI and instead deprecated the tool, directing users to a separate tool called Antigravity CLI, according to reporting from Help Net Security.
Has Plugin4Shell actually been used in a real attack? As of the public disclosure, AIR reported no evidence of exploitation in the wild. This is a disclosed vulnerability, not a confirmed security incident.
EXTERNAL SOURCES
- AIR Security — Plugin4Shell Disclosure: https://www.air.security/blog-posts/plugin4shell
- Help Net Security — Zero-Click RCE Vulnerability Hit Four Major AI Coding Agents: https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/
- GBHackers — Plugin4Shell Zero-Click RCE Hits Claude Code, Codex, Copilot and Gemini CLI: https://gbhackers.com/plugin4shell-zero-click-rce/
- Cybersecurity News — Plugin4Shell Zero-Click RCE: https://cybersecuritynews.com/plugin4shell-zero-click-rce/
- Startup Fortune — Plugin4Shell Flaw Hits Claude Code, Codex, Copilot and Gemini CLI: https://startupfortune.com/plugin4shell-flaw-hits-claude-code-codex-copilot-and-gemini-cli/
- daily.dev — Zero-Click RCE Flaw in AI Coding Agents: https://daily.dev/posts/zero-click-rce-flaw-in-ai-coding-agents-let-attackers-swap-in-malicious-plugins-kmy9j53rq
- FourWeekMBA — Claude Code and Codex Patched After Plugin4Shell: https://fourweekmba.com/ai-plugin4shell-claude-code-codex-shared-assumption/