Security researchers at Air Security disclosed Plugin4Shell on 17 September, a zero-click remote code execution flaw that defeats SHA pinning, the mechanism developers rely on to lock an installed plugin to one specific, reviewed version of its code. The bug affects four widely used AI coding agents: Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot and Google’s Gemini CLI.
For Claude Code, Codex and Copilot, the exploit works by creating a git branch whose name matches a plugin’s 40-character commit hash. Git can prioritise that matching branch reference over the actual commit object during checkout, so an agent installs the attacker’s code while still reporting the expected, reviewed SHA as a successful install. Gemini CLI has its own variant: its plugin process checks out FETCH_HEAD after fetching the intended commit, and a repository branch literally named FETCH_HEAD can redirect that checkout to malicious content instead. Installed plugins typically inherit the same permissions as the developer running the agent, including source code, cloud credentials, SSH keys and production systems.
Anthropic and OpenAI moved fastest, shipping fixes in Claude Code 2.1.179 and Codex 0.146.0 within days of disclosure. Microsoft has not shipped a fix for GitHub Copilot. Google’s response was to retire Gemini CLI rather than patch the underlying flaw, which closes the exposure only for users who actually stop running it.
Researchers estimate the affected install base runs into the millions of active coding-agent sessions. Two of the four platforms named in the disclosure remain exposed as things stand, and neither Microsoft nor Google has given a timeline for when, or whether, that changes.
