OpenAI Codex

Plugin4Shell: a design flaw AIR rates zero-click breaks plugin SHA-pinning in Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI

Security firm AIR disclosed Plugin4Shell on 2026-09-17: a remote-code-execution design flaw, zero-click by AIR's account, present in four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. All four implement plugin-marketplace SHA-pinning, locking each install to a reviewed 40-hex commit hash, but none verifies after checkout that the resolved working tree actually matches that hash (AIR Security, 2026-09-17). An attacker who controls or takes over a trusted plugin's upstream repository creates a branch named identically to the pinned SHA and sets it as the repository's default branch; Claude Code, Codex and Copilot run a plain git clone followed by a checkout of the pinned commit, and because git resolves an ambiguous ref-versus-object-id in favor of the ref, the checkout silently resolves to the attacker's branch while the agent reports the pinned commit installed (AIR Security, 2026-09-17). Gemini CLI has a distinct variant: it fetches the pinned commit into FETCH_HEAD then checks that out, which an attacker defeats by naming their malicious default branch literally "FETCH_HEAD" (AIR Security, 2026-09-17).

Because background plugin auto-update is the default in Claude Code and Codex, an already-installed, already-reviewed plugin is silently swapped on the next update with no install step and no prompt: full zero-click compromise of the agent and "full access to every asset and every piece of data the agent can reach" (AIR Security, 2026-09-17). AIR built a working test attack against all four agents in May 2026 and disclosed it to the vendors in June (The Hacker News, 2026-09-18). OpenAI's own public fix for the same bug shipped in Codex 0.146.0, and AIR says Anthropic fixed it in Claude Code 2.1.179, which Anthropic's release notes do not mention (The Hacker News, 2026-09-18). AIR wrote at disclosure that Microsoft had shipped no fix for Copilot (AIR Security, 2026-09-17). By 2026-09-30 heise online had updated its article to report, citing GitHub support, that GitHub closed the flaw in Copilot CLI 1.0.87 and in the Copilot app 1.1.23, and that the fix checks whether the checked-out code matches the pinned commit (translated from German) (heise online, 2026-09-21). Consumer Gemini CLI is being deprecated rather than patched, so every existing install "stays vulnerable for good" (AIR Security, 2026-09-17). On 2026-08-04 the researchers received Google's confirmation that consumer Gemini CLI is being discontinued and will get no fix (heise online, 2026-09-21). Enterprise access via Gemini Code Assist or Google Cloud is not affected by the discontinuation, and Google's replacement, Antigravity CLI, currently has no comparable SHA-pinning mechanism to bypass (translated from German) (heise online, 2026-09-21). Google says enterprise access to the Gemini CLI will continue with updates, and whether a fix for this flaw is among them is not clear (The Hacker News, 2026-09-18).

The Hacker News independently checked the shipped plugin catalogs on 2026-09-18 and adds a material scope caveat: background auto-update is on by default only for each agent's own built-in, GitHub-hosted marketplace, and every plugin it checked in Anthropic's community catalog and the default Claude Code/Copilot catalogs points to a GitHub repository, which rejects SHA-shaped branch names outright, so the branch-hijack variant does not reach a user who installs only from an agent's default marketplace (The Hacker News, 2026-09-18). The risk concentrates on externally-hosted marketplaces: AIR and The Hacker News name Bitbucket and self-hosted git servers (The Hacker News, 2026-09-18), while heise online states that GitLab, like GitHub, rejects branch names in commit-hash format and is not exploitable this way (translated from German) (heise online, 2026-09-21). On those outside marketplaces auto-update is off or optional (The Hacker News, 2026-09-18). Gemini CLI's FETCH_HEAD-named-branch variant is not clearly blocked by GitHub's hash-name restriction, so a GitHub-hosted Gemini plugin is not established as safe (The Hacker News, 2026-09-18). As of 2026-09-18, no CVE identifier had been assigned and no source reported exploitation in the wild (The Hacker News, 2026-09-18).

GitSpawn (CVE-2026-72718); a hostile repository's own git config runs arbitrary commands during AI coding agents' routine startup housekeeping, before any trust prompt

Manifold Security's GitSpawn research starts from an operational fact about how CLI AI coding agents behave: on opening a folder, several gather repository context by running ordinary git commands (git status, git diff) before the agent has received a prompt, shown a workspace-trust dialog, or in some cases completed authentication (Manifold Security, 2026-09-01). Any git command that refreshes the index honours the repository's own .git/config, including core.fsmonitor, a performance hook where git hands the index refresh off to an external helper program named in that config file. A hostile .git/config setting [core] fsmonitor = <arbitrary command> turns the agent's own routine startup housekeeping into unconditional command execution, with no approval prompt and nothing shown on screen (Manifold Security, 2026-09-01). Delivery is narrower than a typical supply-chain vector: cloning, fetching or pulling from a hostile URL does not carry .git/config across, so the repository has to arrive as files with its .git directory already present, a shared zip, a sync folder, a shared drive, or a USB stick, the way colleagues and consultants routinely hand off projects (Manifold Security, 2026-09-01).

Manifold reports eight findings across seven agents, four of which remain unpatched at publication. Confirmed patched: Goose's git diff sink during goose review (CVE-2026-72718, CVSS 4.0 7.0, fixed in 1.44.0), Claude Code's core.fsmonitor sink (fixed in 2.1.196), OpenAI Codex, and Cursor. OpenAI separately disclosed and patched three of its own CVEs for a distinct Codex helper mechanism in the same vulnerability class, crediting three unrelated research groups; only CVE-2026-19592 is named in the cited reporting, describing a helper that runs outside Codex's command sandbox without a user-approval prompt and can read, change or delete the user's files (The Hacker News, 2026-09-02). Confirmed unpatched as of Manifold's 1 September 2026 recheck: Claude Code carries a second, separate sink in claude ultrareview, "not core.fsmonitor ... a different git setting of the same kind, one the review path does not strip," per Manifold, which withholds the specific config key while it remains unfixed; Qwen Code's git status fires at startup, before authentication; Grok Build's payload fires on the first keystroke, with an earlier July report on the same class closed by xAI as "informative"; and Hermes Agent's git status on first message remains unpatched despite six contact attempts across five channels, with VulnCheck assigning CVE-2026-71963 in the vendor's place (Manifold Security, 2026-09-01; The Hacker News, 2026-09-02). Manifold states the underlying pattern is not limited to the named agents and spans both major AI labs and large software companies (heise Security, 2026-09-02).

Mitigation is two-sided: a defender receiving a repository as files should inspect .git/config before opening it in any agent (any entry naming an external program is suspicious) and an agent vendor's own fix is to sanitise the git config on context-gathering calls, e.g. git -c core.fsmonitor=false status (Manifold Security, 2026-09-01). Triage: a git subprocess spawned by an AI coding agent that itself spawns a further, unrelated child process, particularly one launched before the agent has logged any user prompt or shown a trust dialog, is not normal agent startup behaviour and is the observable signature the mechanism supports.

Coding-agent CI harnesses broke on the same trust boundary three different ways, and the two findings that matter most carry no CVE at all

Three AI coding-agent CI harnesses were broken in different ways by the same underlying question: what, inside an automated pipeline, is the agent allowed to treat as authoritative? Novee Security tested each against the vendor's own public repository in default configuration (Novee Security, 2026-08-05).

The Claude Code Action work is best read as three successive rounds of patch-and-bypass, and only the last of them carries an identifier. Round one turned on an ordering mistake in defensive code: the command-injection validation pipeline strips single-quoted content before inspecting a command, a sensible-looking measure to avoid false positives on shell metacharacters inside string literals. That means an injected payload placed inside single quotes is examined only after the interesting part has been removed. A validator that sanitises its input before deciding whether the input is dangerous is checking something other than what will execute. Round two was an asymmetry in the allowlist itself, where commands classed as read-only were exempted from path checking, so a read-only utility could be pointed at any file on the runner. Neither round carries a CVE. The identifier belongs to the third round, and Anthropic's own advisory states what it covers: "Because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain (including attacker-controlled model repositories) was auto-approved without a permission prompt or being subject to --allowedTools restrictions." The advisory records the affected range as 0.2.54 up to 2.1.163 and the fix in 2.1.163 (Anthropic, 2026-06-13). The Google finding is tracked as CVE-2026-12537 (OSV, 2026-04-24). Google's own advisory rates it Critical, CVSS 10.0, and fixes it in @google/gemini-cli 0.39.1 and run-gemini-cli 0.1.22 (Google, 2026-04-24).

Both of those were patched weeks to months before the write-up appeared, so for those two vendors the action is a version check, not an incident. Their mechanics are still worth carrying, because the lesson generalises to anyone building command allowlists rather than merely consuming these products. In the Gemini CLI finding, where the environment was sanitised only for a child process, the write-up's phrasing of the step that reached the runner's secrets is worth quoting for how narrow the distinction is: "cat /proc/$PPID/environ reads the parent, not self, and pulls from the process that still holds every single thing the isolation was built to keep away." (Novee Security, 2026-08-05)

The third finding is the one that is genuinely current, and it has no CVE because, as the researchers observe, nobody files one for newly documented behaviour. In an OpenAI Codex workflow, two agent passes ran over a single shared checkout, and the agent's own default instruction file sat in that checkout outside the protected-metadata set. That file "is loaded from disk on every single invocation and injected as instructions the model treats as authoritative", so a first pass induced to modify it dictates what the second pass believes it has been told to do. The fix was structural rather than a patch: "3 Days after our report they fixed it and the two passes on openai/codex were split into separate jobs, each with its own checkout." That change landed in the vendor's own repository. It does not propagate to anyone else's pipeline, because the flaw is not in a shipped component; it is in a workflow shape.