Security firm AIR has disclosed a vulnerability that strikes at the heart of how AI coding agents are supposed to stay safe: a flaw named Plugin4Shell that lets attackers silently replace trusted, already-approved plugin code with malicious code — without the victim clicking, approving, or reinstalling anything.
The bug affects four of the most widely used AI coding agents on the market: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. According to AIR, it is the first supply-chain-style vulnerability to hit the AI agent ecosystem specifically, rather than targeting the underlying AI models themselves.
How the exploit works
Modern coding agents let developers install plugins, skills, and extensions from community marketplaces. These add-ons typically inherit the same permissions as the developer running the agent — meaning access to source code, cloud credentials, SSH keys, internal repositories, and production systems.
To keep this safe, marketplaces rely on SHA pinning: once a plugin is reviewed, it gets locked to a specific Git commit hash, so it cannot change without the developer's knowledge. Plugin4Shell breaks that assumption. AIR found that all four affected agents check out the pinned commit without verifying the checkout actually landed on that exact commit — creating room for attackers to exploit Git's handling of reference names.
For Claude Code, Codex, and Copilot, an attacker can create a branch whose name matches the 40-character commit hash. Git may resolve the branch name instead of the intended commit object, letting malicious code install while the agent reports a successful, "trusted" installation. Gemini CLI has a separate variant involving how it checks out FETCH_HEAD during updates, with the same end result.
What makes this zero-click is background auto-updating. Claude Code and Codex both auto-update installed plugins by default, so once an attacker stages a malicious branch, the swap can reach already-installed plugins with no action from the user at all.
Two attack paths, both already proven
AIR says it has demonstrated both routes this exploit can take in earlier research. In one, an attacker publishes a plugin that works exactly as advertised, passes review, and only turns malicious later — a technique AIR previously showed spreading to more than 26,000 agents before being pulled. In the other, an attacker takes over the repository behind a plugin people already trust and already have installed, a method AIR calls "SkillJacking," which it found had already compromised 925 skills in active use, reaching 134,000 agents.
"The exposure is not limited to users who install plugins carelessly," AIR researchers wrote. "The victim only has to have a plugin installed, from a marketplace they trust, that was reviewed and pinned exactly as the security model intends."
An uneven vendor response
AIR reported the flaw to all four vendors in June 2026, giving them months to respond before public disclosure on September 18. The response has been split. Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in version 0.146.0. Microsoft has not shipped a fix for Copilot, and GitHub has argued its naming restrictions on GitHub-hosted repositories limit the attack surface — though that protection doesn't extend to plugin marketplaces hosted elsewhere, like Bitbucket or self-hosted Git servers.
Google took the most drastic route: rather than patch Gemini CLI, it deprecated the tool entirely, meaning every existing install remains permanently exposed. Google's advice to affected users is to migrate to its newer Antigravity agent, which was not built with the vulnerable plugin-pinning system.
What developers should do now
If you use Claude Code or Codex, confirm you're on the patched versions (2.1.179 and 0.146.0 respectively) by running the relevant version-check command, and update immediately if not. If you use Copilot or Gemini CLI, there is currently no patch — treat plugin provenance as your main defense: favor plugins from GitHub-hosted marketplaces over Bitbucket or self-hosted sources, and consider disabling automatic plugin updates until you can manually verify what's installed.
Plugin4Shell is a reminder that as AI agents gain more autonomy and system access, the software supply chain feeding them — not just the models themselves — is becoming a serious attack surface in its own right.