Plugin4Shell hits four coding tools: one plugin flaw, four developer agents exposed

A shared failure in the new developer supply chain

Plugin4Shell is the kind of vulnerability that security teams fear most: not a bug isolated to one product, but a repeated design mistake across the tools developers increasingly treat as co-workers. Reporting over the past 72 hours identified the flaw in four major AI coding agents: Anthropic’s Claude Code, OpenAI Codex, GitHub Copilot and Google Gemini CLI [1]. The core issue is deceptively simple: an agent may appear to install a plugin pinned to a reviewed commit, while actually checking out and running different code [2].

That matters because AI coding tools no longer just suggest text. In modern development environments, they inspect repositories, run shell commands, edit files, call internal tools and sometimes sit beside credentials, deployment scripts and production code. A plugin flaw in that context is not merely a chatbot safety problem. It is a software supply-chain problem with a developer’s permissions attached.

The disclosure also arrives with an uneven patch picture. Anthropic has patched Claude Code in version 2.1.179, and OpenAI has patched Codex in version 0.146.0, according to reports citing AIR Security’s research [2]. GitHub Copilot had no agent-side fix reported at the time of publication, while Google is not patching the deprecated Gemini CLI and is directing users toward its newer Antigravity environment [3].

How the “pin” stopped pinning

The defense Plugin4Shell undermines is SHA pinning. In ordinary terms, a marketplace reviews a plugin at a specific commit and records the commit hash, so future installs should fetch exactly that snapshot rather than whatever a branch or tag later points to. In theory, that protects users if a plugin repository is later compromised or if a maintainer turns malicious.

AIR Security’s finding, as summarized by several outlets, is that the affected agents checked out the pinned reference but did not verify that the resulting working tree actually matched the pinned commit [2]. For Claude Code, Codex and GitHub Copilot, the attack depends on Git behavior around ambiguous names: on hosts that allow branch or tag names resembling a 40-character commit hash, a repository owner can make the checkout resolve to a branch rather than the intended immutable object [2].

The result is a lock that looks closed from the marketplace’s point of view but is open on the machine running the agent. The marketplace can say, “install this reviewed commit,” yet the agent may run something else because the final verification step is missing. That missing check is the difference between pinning as a security boundary and pinning as security theater.

Gemini CLI is described as exposed through a different checkout mechanism, but with the same practical result: the agent can end up running code that is not the intended pinned snapshot [3]. That distinction matters for defenders, because a mitigation that blocks hash-shaped branch names may reduce one variant of the attack but does not necessarily eliminate all Plugin4Shell paths.

Why it becomes zero-click

Plugin4Shell is especially concerning because it can move from “install-time trick” to zero-click compromise. AIR’s scenario relies on background plugin updates: a benign plugin is accepted into a trusted marketplace, users install it, and later the marketplace approves a routine-looking update to another benign commit. Once the pin changes, an attacker who controls the repository can manipulate the checkout target so installed agents update to malicious code without a new user action [1].

Help Net Security reported that background auto-update is what makes the swap reach already installed plugins without a prompt, and that Claude Code and Codex use such updates by default [3]. The Hacker News added an important narrowing point: auto-update is default for the agents’ own built-in marketplaces, which it found were GitHub-based, while external marketplace behavior can be optional or different [2].

That nuance is important. The risk is not identical for every plugin source, every host and every agent. GitHub says it blocks branch and tag names that resemble commit hashes, reducing the branch-name version of the attack for repositories hosted there [2]. But AIR’s position, repeated in The Register, is that the affected agents can use marketplaces or repositories hosted elsewhere, including Bitbucket or self-hosted Git systems, where such names may be allowed [1]. In other words, a GitHub-only shop may face a narrower version of the threat, but the agent-side bug still matters wherever the tool accepts plugins from more permissive hosts.

The patch status is part of the story

The timeline reported by AIR and covered by multiple security outlets says the bug was found in May 2026 and disclosed to vendors in June [3]. By mid-September, the public remediation picture was mixed: Claude Code fixed in 2.1.179, Codex fixed in 0.146.0, Copilot without a reported fix, and Gemini CLI effectively orphaned because Google has deprecated it [2].

SecurityWeek’s roundup framed Plugin4Shell as one of the week’s notable cybersecurity developments and described it as a zero-click flaw affecting the four AI coding agents, allowing an attacker controlling a plugin repository to swap a pinned, reviewed commit for malicious code without tripping the SHA-pinning check [4]. That concise summary captures the business risk: organizations may have followed the recommended workflow — use a marketplace, review a plugin, pin the commit — and still inherited a break in the trust model.

The Hacker News also reported that, as of September 18, no CVE had been assigned, none of the four vendors had published a dedicated security advisory for the flaw, and there was no sign of exploitation in the wild [2]. Absence of known exploitation should not be mistaken for low impact. The affected tools sit on developer workstations and can reach source code, secrets and internal systems; a successful malicious plugin does not need to escalate privileges if the agent already runs with useful ones.

What engineering teams should do now

The first step is straightforward: update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later where those tools are in use [2]. Teams still running Gemini CLI should treat the tool as a legacy risk and evaluate migration to Antigravity or another environment not exposed through the same deprecated plugin system [3]. Copilot users should monitor vendor guidance closely and restrict plugin sources until an agent-side fix is clear.

The second step is architectural. Plugin4Shell shows that AI coding assistants need the same supply-chain controls as package managers, CI runners and build systems — plus stronger runtime isolation. Do not assume that a plugin marketplace review is enough. Require signed extensions where possible, verify the resolved commit locally, restrict plugin sources to hosts with strong ref-name protections, and log plugin installs and updates.

The third step is permissions. Coding agents should not automatically inherit a developer’s entire environment. Least privilege means separate workspaces, minimal filesystem access, scoped credentials, network egress controls and explicit approval for shell execution. A malicious plugin should not be able to read every repository, every token and every deployment secret simply because the developer’s normal shell can.

Plugin4Shell’s lesson is bigger than one patch cycle. AI coding assistants are becoming a new execution layer in software development. If that layer can install tools, update itself, and act with developer privileges, then its extension system is part of the production supply chain. Four tools, one shell: the vulnerability clearly believed in write once, panic everywhere.

Sources from the last 72 hours

1. [1]AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdomSep 17, 2026, 11:42 PM UTC
2. [2]Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding AgentsSep 18, 2026, 11:01 AM UTC
3. [3]Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatchedSep 18, 2026, 12:00 AM UTC
4. [4]In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP FlawSep 18, 2026, 2:25 PM UTC

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.