The news
Primary: Air Security, 17 September 2026, Plugin4Shell, by Or Nevo, Dor Granat, and Niv Hoffman.
Plugin4Shell is Air's name for a zero-click remote code execution path through a plugin SHA-pinning bypass in four major AI coding agents: Claude Code, Codex, GitHub Copilot, and Gemini CLI.
High-level mechanism (public Air description only): the agent checks out the marketplace-pinned commit but does not verify that the pinned commit is what landed in the working tree. An attacker who controls the plugin repository can cause checkout to resolve to malicious code while the pin still looks honored. One public variant uses a branch named like the pinned SHA; git can prefer that ref over the commit object. Plugin auto-update (default in Claude Code and Codex, per Air) can pull the swap onto already-installed plugins with no install prompt. Air frames this as an agent-side resolution bug. A marketplace alone cannot fully close it.
Air places Plugin4Shell after its earlier public posts on marketplace planting and repository takeover (The Story of Skills; SkillJacking). Cite those only as Air's own prior framing.
Air states that enterprises using Air Marketplace and Air Filter were not affected. Treat that as a vendor claim.
This Dispatch does not reproduce exploit steps, payloads, or PoC detail beyond the high-level public mechanism above.
Who is bound
| Product | Vendor | Patch status (per Air, 17 Sep 2026) |
|---|---|---|
| Claude Code | Anthropic | Fixed in 2.1.179 (confirmed 2026-06-17) |
| Codex | OpenAI | 0.146.0 verified fixed 2026-08-12 |
| GitHub Copilot | Microsoft / GitHub | Disclosed; no patch shipped as of the Air report; users have no patch |
| Gemini CLI | Deprecated; Google confirmed no fix will ship (2026-08-04); Air advises migrate to Antigravity (Air says the attack does not reach Antigravity because it has no marketplace plugin SHA-pinning to bypass) |
Anyone running those agents with marketplace plugins installed is in scope on Air's description. Air emphasizes that careful review-plus-pin workflows still fail if the agent never asserts that HEAD equals the pinned SHA after checkout.
No regulator order attaches to this disclosure. Operators and vendors carry the patch and migration choices.
What's new
- A public, coordinated-disclosure writeup that the same missing post-checkout pin check appears across four major coding agents.
- A clear split in vendor response: two patched versions, one deprecation-without-fix, one disclosed-without-patch as of 17 September 2026.
- Emphasis that auto-update turns a pin-resolution bug into zero-click replacement of an already-trusted plugin.
- Air's claim that pin enforcement must live inside the agent, because the client resolves the pin.
Coordinated disclosure timeline (Air):
| When | What |
|---|---|
| May 2026 | Found by Air Security research lab |
| June 2026 | Disclosed to all four vendors |
| 2026-06-17 | Anthropic confirms fix in Claude Code 2.1.179 |
| 2026-08-04 | Google confirms no fix; Gemini CLI deprecated; migrate to Antigravity |
| 2026-08-12 | Codex 0.146.0 verified fixed |
| 2026-09-17 | Public report |
What it does not settle
- Whether Microsoft / GitHub has shipped a Copilot agent-side fix after the Air post date. Fact-check 19 September 2026: no Microsoft/GitHub Plugin4Shell patch advisory or CVE found after the Air post. Secondary wires (The Register, The Hacker News, through ~18 Sep) still report no Copilot patch; GitHub told The Register that SHA-like branch/tag names are blocked on GitHub, which Air disputes as incomplete for Bitbucket and other hosts Copilot can use. Treat Copilot marketplace plugins as elevated risk until a vendor agent-side patch is confirmed.
- How many agents were actually compromised in the wild via Plugin4Shell. Air does not give a confirmed victim count in the sections we rely on here.
- Whether every marketplace host allows SHA-shaped branch names. Air notes GitHub rejects 40-hex branch names while some other hosts and self-hosted git allow them. Exact host matrix for each agent's supported marketplaces: treat Air's text as the source; do not invent coverage.
- Whether operators can disable auto-update on every affected agent. Air says auto-update is default in Claude Code and Codex. Universal disable switches: UNKNOWN.
- Independence of Air's "not affected" claim for Air Marketplace / Air Filter customers. Vendor claim only.
What to do now
- Update Claude Code to 2.1.179 or newer.
- Update Codex to 0.146.0 or newer.
- Treat GitHub Copilot plugin installs and auto-updates as elevated risk until a vendor patch is confirmed; reduce marketplace plugin surface where you can.
- Gemini CLI users: plan migration to Antigravity (or another maintained agent). Air states Google will not patch Gemini CLI.
- Prefer agents that assert the working-tree commit equals the pinned SHA after checkout. Pin verification is an agent-side control.
- Inventory which plugins your org auto-updates, which git hosts back those plugins, and who can push to those repos.
- If you evaluate Air Marketplace / Air Filter as mitigation, demand evidence beyond the blog's vendor claim.
- Do not run public PoC material against production agents. Patch and inventory first.