Pull to refresh
Logo
What Changed
Following Why Sign Up
Plugin4Shell flaw hits top AI coding agents; two major vendors unpatched

Plugin4Shell flaw hits top AI coding agents; two major vendors unpatched

New Capabilities

SHA-pinning bypass lets attackers install malicious plugins in Claude Code, Codex, Copilot, and Gemini CLI with no user action

September 17th, 2026: Public disclosure of Plugin4Shell

Overview

Updated Sep 18

The four most popular AI coding agents carried a zero-click vulnerability that lets an attacker replace a trusted plugin with malicious code. The agents install the replacement silently, with no user action and no prompt.

The flaw, named Plugin4Shell, defeats SHA-pinning, the mechanism meant to lock a plugin to an audited code commit. Anthropic and OpenAI patched. Google won't fix its deprecated Gemini CLI, and Microsoft has no Copilot patch, though about 90% of Fortune 500 companies use it.

Why it matters

Enterprises running unpatched Copilot or Gemini CLI have a zero-click hole that hands attackers full access to employee systems and data.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

4
Major coding agents affected
Claude Code, Codex, Copilot, and Gemini CLI all share the same SHA-pinning design flaw.
2 of 4
Vendors that shipped patches
Anthropic fixed Claude Code 2.1.179; OpenAI fixed Codex 0.146.0. Google and Microsoft have not.
~90%
Fortune 500 companies using Copilot
Microsoft's figure. Copilot has no shipped fix for Plugin4Shell.
26,000+
Agents seized in prior Air research
The Story of Skills showed a malicious skill in a trusted marketplace could take over agents.

Voices

Curated perspectives — historical figures and your fellow readers.

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

Or Nevo
Or Nevo
Security researcher at Air Security
Co-authored the Plugin4Shell disclosure
 Dor Granat
Dor Granat
Security researcher at Air Security
Co-authored the Plugin4Shell disclosure
NH
Niv Hoffman
Security researcher at Air Security
Co-authored the Plugin4Shell disclosure

Organizations Involved

Air Security
Air Security
Security research startup
Disclosed Plugin4Shell to all four vendors

Security startup focused on protecting enterprise AI agents.
Anthropic
Anthropic
AI foundation-model lab
Patched Plugin4Shell in Claude Code 2.1.179

Maker of the Claude Code coding agent.
OpenAI
OpenAI
AI foundation-model lab
Patched Plugin4Shell in Codex 0.146.0

Maker of the Codex coding agent.
Google
Google
Technology company (Alphabet subsidiary)
Declined to patch deprecated Gemini CLI

Maker of the Gemini CLI, now deprecated.
Microsoft
Microsoft
Technology company
No Copilot patch shipped; GitHub says it is not affected

Maker of the Copilot coding agent and owner of GitHub.

Timeline

May 2026 September 2026

6 events Latest: September 17th, 2026 · 2 months ago
Tap a bar to jump to that date

  1. Public disclosure of Plugin4Shell

    Latest Public Disclosure

    Air publicly discloses the vulnerability; The Register reports that Microsoft and Google remain unpatched.

  2. OpenAI's Codex verified fixed

    Patch

    Codex 0.146.0 is confirmed to close the flaw.

  3. Google declines to patch Gemini CLI

    Disclosure

    Google says Gemini CLI gets no fix because it is deprecated; users are told to migrate to Antigravity.

  4. Anthropic ships Claude Code fix

    Patch

    Anthropic confirms the fix in Claude Code 2.1.179.

  5. Disclosed to all four vendors

    Disclosure

    Air reports Plugin4Shell to Anthropic, OpenAI, Google, and Microsoft under coordinated disclosure.

  6. Air Security discovers Plugin4Shell

    Research

    Air Security finds the flaw and builds working exploits against all four coding agents.

Scenarios

1

Microsoft ships a Copilot patch within six months

Possible Resolves by Mar 17, 2027

Discussed by: Air Security researchers, who said updating is the only complete mitigation

Microsoft releases a Copilot update that verifies the plugin checkout actually landed on the pinned commit. GitHub's SHA-shaped-name policy is already in place, but Air researchers say it doesn't cover marketplaces hosted on platforms like Bitbucket, so a real fix must ship in the agent itself.

2

Plugin4Shell exploited against unpatched agents in the wild

Possible Resolves by Q2 2027

Discussed by: The Register and Air Security

An attacker exploits the unpatched Copilot or Gemini CLI, either by turning a benign plugin malicious or hijacking a repository. Because auto-update installs silently by default, one compromised plugin reaches every agent that has it installed before anyone notices.

3

SHA-pinning bypass resurfaces in other AI agents

Likely Resolves by Q2 2027

Discussed by: Manifold Security and shattered.io, via the related GitSpawn findings

Other agents that adopted SHA pinning repeat the same design mistake, or a variant of Plugin4Shell emerges as the AI agent ecosystem grows. GitSpawn already showed the vulnerability class extends beyond the original four, with seven agents affected and four unpatched at publication.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

December 2020

SolarWinds (2020)

Attackers compromised SolarWinds' build system and injected backdoored code into Orion software updates, distributing it to roughly 18,000 customers, including US federal agencies.

Then

Months of breach response across government and private networks; multiple agencies confirmed compromised.

Now

Rewrote expectations about software supply chain security, pushing code-signing and build-integrity standards across the industry.

Why this matters now

Plugin4Shell is the same trust-in-updates problem, now in AI agents: users trust a mechanism they cannot fully verify.

November 2018

event-stream npm compromise (2018)

A maintainer handed the popular event-stream npm package to a new contributor, who added code that stole bitcoin wallet keys. The package had about 8 million weekly downloads.

Then

The malicious version was taken down and the package flagged, but the wallet-stealing code had already reached users.

Now

Raised awareness of maintainer-takeover risk in open-source registries and led to stricter ownership policies.

Why this matters now

Plugin marketplaces are the new npm: trust in a repository that can be hijacked or silently altered.

March 2024

xz-utils backdoor (2024)

An attacker maintained the xz compression library for years, gaining trust, then nearly merged a backdoor into versions used by major Linux distributions.

Then

The backdoor was caught before widespread deployment, but only by luck and close inspection.

Now

Showed how patient, sophisticated supply chain attackers groom maintainers and interweave malicious code into trusted open source.

Why this matters now

Plugin4Shell's second attack method, hijacking a legitimate author's repository, follows the same trust-grooming playbook.

Sources

(4)
Air Security The Register Shattered.io Manifold Security