Disclosed on 18 September 2026, Plugin4Shell is a zero-click remote code execution flaw affecting the plugin systems of four widely used AI coding agents: Claude Code, Codex, GitHub Copilot and Gemini CLI. Researchers at AIR, who found it, describe it as the first supply chain vulnerability of the AI agent ecosystem. The uncomfortable detail is who it punishes.
Pinning a plugin to a specific reviewed commit hash is the recommended practice. It is what a careful team does. Plugin4Shell defeats exactly that control — and the pin continues to look intact the whole time.
Doing the right thing does not protect you. The version string in your configuration still reads as the commit you reviewed, and different code is running.
The git behaviour at the heart of it
Git resolves a reference you hand it by working through an order of precedence. A forty-character hex string looks like a commit object, but it is not reserved — git will also accept it as a branch name, and when a branch of that name exists, the branch can win.
So an attacker who controls a plugin repository can create a branch whose name is the same hex string as the commit the marketplace has pinned. Anything can be at the tip of that branch.
Why the agents did not catch it
The finding is not that git behaves this way — that is documented. The finding is that all four agents checked out the pinned reference and never verified that the checkout actually landed on that commit. One line of post-checkout verification, comparing resolved HEAD against the requested hash, would have closed it. None of the four did it.
The result is a silent substitution. The agent reports the pinned version. The lockfile is unchanged. The code executing is the attacker's.
Why zero-click
Plugins update in the background. No user action is required, no prompt is shown, and there is no install step for anyone to scrutinise. And because plugins run with the user's own privileges, the attacker inherits everything the developer has: source code, credentials on disk, SSH keys, cloud sessions, CI tokens, and whatever the agent itself is authorised to touch.
A developer workstation is, in practice, one of the highest-value endpoints in most organisations. It holds the keys to the estate and is frequently the least constrained machine on the network.
What actually has to be true to exploit it
This is where the real-world risk needs stating honestly, because the preconditions matter.
- The attacker must control the plugin repository — as its owner, or through a compromise or transfer of it.
- The hosting platform must permit branch names that look like commit hashes. This is the load-bearing condition.
GitHub blocks branch and tag names resembling commit hashes. Plugins sourced from GitHub are therefore not exploitable by this route. Bitbucket and self-hosted git servers do permit it, and that is where the exposure sits.
The researchers note that every plugin in Anthropic's community catalogue, and in the default catalogues for Claude Code and Copilot, points at a GitHub repository — and auto-update defaults to GitHub-hosted marketplaces. For teams using default catalogues only, immediate risk is limited.
The exposure is concentrated somewhere specific, and it is somewhere enterprises live: internal plugin marketplaces on self-hosted git. An organisation that took the security-conscious decision to host its own agent plugins internally, rather than pull from a public catalogue, has quietly moved itself into the vulnerable population. That is worth saying plainly to whoever made that decision, because they made it for good reasons.
Patch status
| Agent | Vendor | Status | Fixed version |
|---|---|---|---|
| Claude Code | Anthropic | Patched | 2.1.179 and later |
| Codex | OpenAI | Patched | 0.146.0 and later |
| GitHub Copilot | Microsoft | No patch released | — |
| Gemini CLI | Deprecated rather than patched | Migrate to Antigravity |
No CVE identifiers have been published for the issue at the time of writing. AIR reported finding it in May 2026 and disclosing to vendors in June 2026, with public disclosure in September.
Two of four fixed, one unfixed, one retired in place of a fix. If your developers are running Copilot against a self-hosted or Bitbucket-hosted plugin source, there is currently no patch to apply and the mitigations below are the control.
What to do now
- Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Confirm it rather than assume it — agent versions drift widely across a development team, and auto-update is not always on.
- Establish where your agent plugins come from. This is the question that determines your exposure, and in most organisations nobody currently owns the answer. GitHub-hosted is not exploitable by this route. Bitbucket or self-hosted is.
- If you run an internal plugin marketplace, configure the git server to reject branch and tag names that look like object hashes. This is the single most effective control available, it is a server-side setting, and it protects every client regardless of patch status.
- Audit the repositories your pinned plugins point at for existing hash-shaped branch names. Their presence is not proof of attack, but there is no legitimate reason for one.
- Restrict what agents may do without confirmation on developer workstations, and keep developer endpoints inside your EDR and telemetry coverage. They are too often treated as an exception because the tooling is noisy.
- Bring AI agent tooling into the software inventory. Agents, their plugins and their marketplaces are now dependencies with a supply chain, and most asset registers do not yet list them.
The wider point
Plugin4Shell is a small bug with a large blast radius, and the interesting part is not the git trivia. It is that an entire category of tooling arrived inside enterprises very quickly, carrying its own dependency ecosystem, and that ecosystem inherited the trust model of the person running it without inheriting the review process that usually accompanies that level of access.
Every assumption that held for package managers holds here too, and had to be rediscovered: pinning only works if the pin is verified, provenance matters more than version strings, and "it updated itself in the background" is a distribution mechanism an attacker will always find attractive.
The practical takeaway for a security team is narrower than the headline suggests. Ask where your agent plugins come from. If the answer is a self-hosted git server, fix the branch-naming rule this week. If nobody can answer at all, that is the more useful finding of the two.