Plugin4Shell bypasses safeguards in four coding agents

What this is about

Security company Air Security disclosed a vulnerability it calls Plugin4Shell on September 17, 2026. It affects the plugin mechanisms in Claude Code, OpenAI Codex, GitHub Copilot CLI, and Gemini CLI. An attacker who controls the repository of an already trusted plugin can cause the agent to execute code other than the reviewed version pinned by a commit identifier.

This matters because plugins and extensions often have extensive privileges: they can read files, run commands, and access development credentials. Air Security therefore describes the issue as zero-click remote code execution. With automatic updates, execution can happen without another click or approval.

What Plugin4Shell actually does

Many plugin catalogs store a 40-character Git commit identifier, commonly called a SHA. It is supposed to guarantee that every installation checks out exactly the reviewed code. Plugin4Shell exploits cases in which Git can resolve a name as a branch rather than a commit.

For Claude Code, Codex, and Copilot, a repository operator can create a branch on supported Git servers whose name looks exactly like the pinned SHA and make it the default branch. The agent runs a checkout with the expected string but lands on the attacker-controlled branch. GitHub itself rejects such branch names; Bitbucket and self-hosted Git servers can allow them, according to Air Security.

Gemini CLI had a related variant: the correct commit was fetched, but during checkout a branch named FETCH_HEAD could take precedence. The technical defense is small but essential: after checkout, the agent must resolve HEAD and verify that the actual commit exactly equals the expected SHA.

Air Security and The Hacker News report that Anthropic fixed the issue in Claude Code 2.1.179 and OpenAI fixed it in Codex 0.146.0. At the time of reporting, Copilot CLI had no fix, while Google reportedly did not plan to patch the retiring Gemini CLI.

Why it matters

The vulnerability attacks the supply chain beneath the language model rather than the model itself. A plugin can be clean when admitted to a catalog and be swapped later. An attacker could also take over a legitimate repository. A security review then loses its value even though the visible commit identifier still appears trustworthy.

The flaw is especially serious in development environments that can reach source code, package registries, cloud accounts, or signing keys. A successful attack might affect more than one workstation: it could alter software that is later shipped to customers. That makes Plugin4Shell relevant to individual developers and enterprises alike.

In plain language

Imagine a workshop inspects a spare key and records the number stamped on it. Later, it requests that exact number again. The supplier places a differently cut key in a compartment bearing the same name. The workshop reads the correct label but takes the wrong key. The defense is to inspect the key itself after taking it out.

A practical example

A team of 40 developers installs an internal plugin from a reviewed Bitbucket repository. The catalog points to an approved commit. Weeks later, an attacker takes over the repository, creates a branch named with that exact 40-character commit string, and makes it the default.

At the next automatic update, 40 agents receive the manipulated version. If the plugin can access source code and environment variables, it could read credentials or modify build scripts. In this scenario, no new manual approval occurs. A secured client instead aborts as soon as the checked-out HEAD differs from the cataloged commit.

Scope and limits

• The attack requires control of the plugin repository or the ability to place a plugin in a trusted catalog and change it later. Plugin4Shell does not provide that control by itself.
• The branch variant does not work on every Git host. GitHub rejects branch names that consist entirely of a 40-character SHA. Other supported hosts may behave differently.
• The claim that millions of agents are affected comes from the discoverer and has not been independently verified. A vulnerable client also does not prove that an attack has occurred.

Teams should inventory installed plugins, update their agents, restrict automatic updates from uncontrolled catalogs, and give development credentials the least privileges possible. Where no vendor patch exists, disabling affected plugin paths is safer than trusting the visible SHA string.

SEO & GEO keywords

Plugin4Shell, Claude Code, OpenAI Codex, GitHub Copilot CLI, Gemini CLI, coding agents, plugin security, Git SHA, software supply chain, remote code execution, Air Security