Plugin4Shell: First Supply-Chain Vulnerability in AI Agent…

The Plugin4Shell vulnerability bypasses SHA pinning in plugins for four AI agents. Two vendors have patched; Microsoft and Google have not. Analysis of the mechanism and vendor responses.

On September 18, 2026, the AIR research team disclosed Plugin4Shell, a vulnerability that bypasses the SHA-pinning mechanism in plugins for Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. Remote code execution is zero-click for Claude Code and Codex, which automatically update plugins in the background. Two vendors have fixed the issue; Microsoft has released no patch, and Google has deprecated Gemini CLI without addressing the defect. The technical mechanism is confirmed by OpenAI PR #34644; additional details come from AIR research not yet peer-reviewed.

Key Takeaways

Four AI agents run plugins by verifying the commit hash but never confirming that the checked-out code actually matches that hash, allowing silent payload substitution.
Claude Code and Codex are vulnerable to zero-click exploitation: automatic plugin updates re-trigger checkout without user interaction.
Anthropic patched Claude Code in version 2.1.179; OpenAI fixed Codex in version 0.146.0.
Microsoft has released no update for GitHub Copilot, used by roughly 90% of the Fortune 100 per GitHub figures.
Google deprecated Gemini CLI without a patch, signaling migration to Antigravity.

How the SHA-Pinning Bypass Works

AI agent plugins are distributed via Git repositories, with the marketplace pinning a specific commit by its 40-character hash. The agent requests that hash and proceeds to checkout, assuming the retrieved code corresponds to the desired commit. AIR research demonstrated this assumption is false.

For Claude Code, Codex, and Copilot, an attacker controlling the remote repository can create a branch named identically to the pinned commit hash. When resolving the reference, Git prioritizes the branch name over the commit object. The agent receives the malicious branch code while the UI continues to display the original hash as the honored pin.

The Gemini CLI variant uses a different but equivalent approach: the installer checks out FETCH_HEAD, and a branch named FETCH_HEAD redirects the operation to arbitrary code. In both cases the result is identical: unauthorized code execution with the appearance of integrity.

The mechanism is documented in the description of pull request #34644 in the OpenAI Codex repository: "Git can interpret a requested commit SHA as a branch name when the remote's default branch has the same name. This can cause a marketplace plugin source to materialize a different commit than the one it pinned." The PR includes a regression test that creates a branch named after another commit's hash, verifying the system rejects it.

Why the Attack Is Zero-Click on Claude Code and Codex

The zero-click dimension applies specifically to Claude Code and Codex. Both automatically re-trigger plugin checkout when the marketplace updates the pin to the next commit. The user does not interact with the process, sees no confirmation prompts, and does not manually select the repository. The agent pulls in the background and, in the branch-collision case, installs the payload with no visual indication of anomaly.

For Copilot and Gemini CLI, the source does not specify whether plugin installation occurs with the same automatic behavior. The brief states "zero-click exploitation possible" for Claude Code and Codex, not extending this property to the other two agents.

AIR built working proofs-of-concept against all four agents in May 2026, followed by coordinated disclosure to vendors in June 2026. No CVE had been assigned as of the publication date; the team found no evidence of in-the-wild exploitation.

"The agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored" — Or Nevo, Dor Granat and Niv Hoffman (AIR)

Asymmetric Vendor Response: Two Patches, Two Gaps

Anthropic released Claude Code version 2.1.179 with post-checkout verification: the system compares the resolved HEAD hash against the requested pin and aborts on mismatch. OpenAI followed the same pattern in Codex version 0.146.0, with pull request #34644 describing the check: "Resolve HEAD after checking out a SHA-pinned Git plugin source and reject when resolved commit does not exactly match requested SHA."

Microsoft, according to AIR and The Register, did not respond to the disclosure by the publication date. GitHub — owned by Microsoft — implemented a partial platform-level mitigation: it blocks creation of branches and tags with names resembling commit SHAs on hosted repositories. This measure protects plugins hosted on GitHub, but Copilot supports third-party marketplaces such as Bitbucket and self-hosted Git servers, where the restriction does not apply. Per AIR, "Microsoft Copilot is also still vulnerable because it supports marketplaces from such platforms as well, which exposes it to the vulnerability."

Google chose to deprecate Gemini CLI without releasing a patch, pointing to migration toward Antigravity. The source does not specify whether Google's announced enterprise versions of Gemini CLI include the fix, nor does it provide a timeline for the transition.

What to Do Now

Environments using Claude Code must update to version 2.1.179 or later; for Codex, to version 0.146.0 or later.
GitHub Copilot users should restrict plugin installation to repositories hosted on GitHub, where the SHA-like name blocking mitigation is active; avoid Bitbucket or self-hosted sources until a Microsoft patch.
For Gemini CLI, evaluate migration to Antigravity per Google's guidance.

Frequently Asked Questions

Does updating the agent remove already-compromised plugins?
The source does not specify whether the update removes already-swapped plugins or only prevents future swaps. Users may need to manually verify existing installations.

Is GitHub completely immune?
No. GitHub's mitigation blocks only SHA-like names, not the FETCH_HEAD variant used against Gemini CLI. Additionally, Copilot supports repositories not hosted on GitHub.

Has a CVE been assigned?
No CVE had been assigned as of the publication date, per available sources.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter