Plugin4Shell: a design flaw AIR rates zero-click breaks plugin SHA-pinning in Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI
AI coding agents' plugin SHA-pinning is bypassable, mainly via plugins hosted on Bitbucket or self-hosted git, and only consumer Gemini CLI stays unfixed
Defender actions
- Upgrade Codex to 0.146.0 or later, Claude Code to 2.1.179 or later, Copilot CLI to 1.0.87 or later and the Copilot app to 1.1.23 or later.
Analysis
Security firm AIR disclosed Plugin4Shell on 2026-09-17: a remote-code-execution design flaw, zero-click by AIR's account, present in four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. All four implement plugin-marketplace SHA-pinning, locking each install to a reviewed 40-hex commit hash, but none verifies after checkout that the resolved working tree actually matches that hash (AIR Security, 2026-09-17). An attacker who controls or takes over a trusted plugin's upstream repository creates a branch named identically to the pinned SHA and sets it as the repository's default branch; Claude Code, Codex and Copilot run a plain git clone followed by a checkout of the pinned commit, and because git resolves an ambiguous ref-versus-object-id in favor of the ref, the checkout silently resolves to the attacker's branch while the agent reports the pinned commit installed (AIR Security, 2026-09-17). Gemini CLI has a distinct variant: it fetches the pinned commit into FETCH_HEAD then checks that out, which an attacker defeats by naming their malicious default branch literally "FETCH_HEAD" (AIR Security, 2026-09-17).
Because background plugin auto-update is the default in Claude Code and Codex, an already-installed, already-reviewed plugin is silently swapped on the next update with no install step and no prompt: full zero-click compromise of the agent and "full access to every asset and every piece of data the agent can reach" (AIR Security, 2026-09-17). AIR built a working test attack against all four agents in May 2026 and disclosed it to the vendors in June (The Hacker News, 2026-09-18). OpenAI's own public fix for the same bug shipped in Codex 0.146.0, and AIR says Anthropic fixed it in Claude Code 2.1.179, which Anthropic's release notes do not mention (The Hacker News, 2026-09-18). AIR wrote at disclosure that Microsoft had shipped no fix for Copilot (AIR Security, 2026-09-17). By 2026-09-30 heise online had updated its article to report, citing GitHub support, that GitHub closed the flaw in Copilot CLI 1.0.87 and in the Copilot app 1.1.23, and that the fix checks whether the checked-out code matches the pinned commit (translated from German) (heise online, 2026-09-21). Consumer Gemini CLI is being deprecated rather than patched, so every existing install "stays vulnerable for good" (AIR Security, 2026-09-17). On 2026-08-04 the researchers received Google's confirmation that consumer Gemini CLI is being discontinued and will get no fix (heise online, 2026-09-21). Enterprise access via Gemini Code Assist or Google Cloud is not affected by the discontinuation, and Google's replacement, Antigravity CLI, currently has no comparable SHA-pinning mechanism to bypass (translated from German) (heise online, 2026-09-21). Google says enterprise access to the Gemini CLI will continue with updates, and whether a fix for this flaw is among them is not clear (The Hacker News, 2026-09-18).
The Hacker News independently checked the shipped plugin catalogs on 2026-09-18 and adds a material scope caveat: background auto-update is on by default only for each agent's own built-in, GitHub-hosted marketplace, and every plugin it checked in Anthropic's community catalog and the default Claude Code/Copilot catalogs points to a GitHub repository, which rejects SHA-shaped branch names outright, so the branch-hijack variant does not reach a user who installs only from an agent's default marketplace (The Hacker News, 2026-09-18). The risk concentrates on externally-hosted marketplaces: AIR and The Hacker News name Bitbucket and self-hosted git servers (The Hacker News, 2026-09-18), while heise online states that GitLab, like GitHub, rejects branch names in commit-hash format and is not exploitable this way (translated from German) (heise online, 2026-09-21). On those outside marketplaces auto-update is off or optional (The Hacker News, 2026-09-18). Gemini CLI's FETCH_HEAD-named-branch variant is not clearly blocked by GitHub's hash-name restriction, so a GitHub-hosted Gemini plugin is not established as safe (The Hacker News, 2026-09-18). As of 2026-09-18, no CVE identifier had been assigned and no source reported exploitation in the wild (The Hacker News, 2026-09-18).
Cited evidence
It is a plugin SHA-pinning bypass: the agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored. The result is zero-click remote code execution across Claude Code, Codex, GitHub Copilot, and Gemini CLI.
Google has deprecated the Gemini CLI and will not patch it, so every install stays vulnerable for good; those users should migrate to Antigravity, which this attack does not reach
Updates2
GitHub has closed the flaw in Copilot: according to GitHub support the fix is in Copilot CLI 1.0.87 and the Copilot app 1.1.23, and it checks whether the checked-out code matches the pinned commit (translated from German) (heise online, 2026-09-21). heise online also now states that GitLab, like GitHub, rejects branch names in commit-hash format and is not exploitable through the branch-name variant (heise online, 2026-09-21). The earlier statements that Copilot had no fix and that heise named GitLab as exposed are superseded.
The Claude Code fix rests on AIR's account alone: Anthropic's release notes for 2.1.179 do not mention it, whereas OpenAI's own public fix for the same bug shipped in Codex 0.146.0 (The Hacker News, 2026-09-18). The branch-name variant also needs a git host that accepts hash-shaped branch names, which GitHub does not, so users who install plugins only from the agents' default GitHub-based marketplaces are not exposed to it (The Hacker News, 2026-09-18). Google's 2026-08-04 confirmation that consumer Gemini CLI will get no fix was given to the researchers, not received by Google's own researchers (heise online, 2026-09-21).
Zero-click is AIR's characterization of the background auto-update path. The Hacker News finds auto-update on by default only for each agent's own GitHub-hosted marketplace, where the branch-name trick does not work, and off or optional for outside marketplaces (The Hacker News, 2026-09-18), so a default installation is not exposed to the branch-name variant without user action. Gemini CLI's exposure runs through a distinct FETCH_HEAD branch variant, and The Hacker News does not establish that installing a Gemini CLI plugin from GitHub avoids it.
Sources4
Revision history
- Published 2026-09-22T0410Z-intel
- Update 2026-09-30T0639Z-audit
GitHub has fixed Copilot (Copilot CLI 1.0.87, Copilot app 1.1.23, according to GitHub support as reported by heise online), and heise now states that GitLab is not exploitable through the branch-name variant. The Claude Code fix is attributed to AIR, since Anthropic's release notes do not mention it, and the GitHub scope limit on the branch-name variant is stated up front. Priority moves from high to notable: developer-tooling research without in-the-wild exploitation. The 2026-08-04 confirmation of no fix for consumer Gemini CLI went to the researchers, not to Google's own researchers.
Changed: priority updated_at headline summary actions body
- Correction 2026-10-11T1307Z-audit
The title stated zero-click and identical exposure as fact; zero-click is AIR's characterization, and The Hacker News finds the default marketplaces unreachable by the branch variant while Gemini CLI has a distinct one. The title now attributes zero-click to AIR and drops 'identically', two uncited sentences on external-marketplace auto-update and the Gemini variant gain their citation with the source's 'off or optional' wording, and the action is cut to the upgrade task.
Changed: title actions body sectors
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.