Plugin4Shell: Swapping Out a "Pinned" Plugin in Four AI Coding Agents

Air Security reported on Thursday a vulnerability affecting four popular AI coding agents at once: Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI. The flaw lets whoever controls a plugin repository swap the installed code for something malicious — even if the agent has bound the plugin to a specific, verified version.

How the "pinning" breaks

Agents install add-ons from online marketplaces, and for safety each plugin is bound to a single verified version by commit hash — a long string that unambiguously points to a snapshot of the code. Air found that the agents download this snapshot but never check that the code they receive actually matches the hash.

The whole trick rests on branch names. If the host allows creating a branch whose name looks like a commit hash, the repository owner can point that name at different code. The agent will install the swapped-in code while still reporting that it's on the "pinned" version. Because the plugin runs with the same privileges as the agent's user, the foreign code gains access to the victim's files, saved credentials and systems.

Where it won't work

GitHub forbids branch and tag names that resemble commit hashes, so plugins from GitHub repositories aren't exposed to this trick. The attack works on platforms that permit such names — for example, Bitbucket or a company's own git server. On September 18, The Hacker News checked the agents' built-in catalogs: every plugin in Anthropic's community and in the default catalogs of Claude Code and Copilot points to GitHub.

Gemini CLI breaks in a different way — through a repository whose main branch is named FETCH_HEAD, which GitHub's rule against hash-like names does not block.

What makes the scenario truly dangerous is background auto-update, enabled by default in Claude Code and Codex: an already installed plugin can be swapped out without a prompt. But auto-update by default applies only to the built-in marketplaces on GitHub, so a user who installs plugins only from the standard catalogs is unaffected.

What's been fixed

According to Air, Anthropic closed the hole in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. GitHub Copilot has no patch, and Google won't be fixing Gemini CLI: the agent is being retired, and users are directed to Antigravity.

Air built a working test against all four agents back in May and notified the developers in June. As of September 18, no CVE identifier has been assigned, no vendor has issued a security advisory, and there are no signs of attacks in the wild. The binding has to be verified on the user's machine rather than in the marketplace, so only the agent itself can fix this. Whether an already swapped-in plugin survives an update or only future swaps are blocked — the sources are silent on this.

Source: The Hacker News