A newly discovered flaw dubbed “Plugin4Shell” enables repository owners to replace a plugin’s code even when it’s supposedly locked to a specific reviewed version. This weakness affects four AI coding agents, exposing users to potential attacks if the repository owner abuses this oversight.
What’s the issue?
AI agents like Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot, and Google’s Gemini CLI support plugins—extensions installed from marketplaces and code repositories. To prevent malicious changes, marketplaces lock each plugin to a specific version, identified by its commit hash. The agents then fetch that exact snapshot of code. However, security firm Air Security found that while agents fetch by hash, they don’t always verify that the code they receive actually matches that hash.
The exploitable loophole involves branch or tag names in repositories that look like commit hashes. A branch named to mimic the locked hash can actually point to different code. Because the agent trusts the name and doesn’t re-check the content against the hash, it ends up installing whatever’s at that misleading branch—even though it reports it’s using the locked version.
Which agents are affected—and what’s being done?
Anthropic has patched Claude Code (version 2.1.179) and OpenAI fixed Codex (version 0.146.0). GitHub Copilot still lacks a fix. Google declined to patch Gemini CLI, which it is retiring in favor of a new agent called Antigravity—this newer system is not vulnerable to the Plugin4Shell trick. Enterprises continuing to use Gemini CLI may not receive a fix. Air Security confirmed testing for all four in May, informed the vendors in June, and as of September 18, found no CVEs assigned or security advisories published.
Not every environment is vulnerable. GitHub disallows branches or tags that look like commit hashes, which prevents this trick when plugins are pulled from GitHub. But repositories hosted on platforms like Bitbucket, or private git servers that allow hash-like branch names, are exposed. Another variant affects the Gemini CLI installer when a repository’s default branch is named FETCH_HEAD—a name that GitHub’s hash restrictions may not block.
Auto-updating makes this trickier: agents often refresh installed plugins in the background. In Claude Code and Codex, auto-update is enabled by default for their built-in GitHub-based marketplaces, increasing risk. For external sources, auto-update is either off or optional. Thus, users installing only from the agents’ default, trusted GitHub catalogs face fewer exposures.
What users need to do now
Users of affected agents should upgrade immediately—Anthropic to Claude Code 2.1.179 or newer, OpenAI to Codex 0.146.0 or newer. Those using GitHub Copilot or Gemini CLI (where fixes are unavailable or not planned) should limit plugin sources to platforms enforcing strict commit-hash matching, or switch to newer agents like Antigravity. Also, turn off auto-updates for plugins from untrusted marketplaces or repositories.
Plugin4Shell upgrades previous risks where malicious links or external references within reviews caused trouble. Now, the threat is deeper: a repository steward can fully redirect plugin behavior under the guise of safety.
Why it matters: this flaw bypasses one of the most critical pieces of plugin security—the version lock. It shows that locking by hash isn’t enough if agents don’t verify what they install. Moving forward, agents need robust hash checking during installation, not just marketplace reviews. Watch for upcoming patches or agent versions explicitly addressing Plugin4Shell. This is a wake-up call about assumptions in software supply chains—one that could affect everything from enterprise environments to individual developers.
