AiCybr

Plugin4Shell: Claude Code and Codex Patched, Copilot and Gemini CLI Remain Exposed

By AiCybr Editorial · Published September 18, 2026

Security researchers at Air Security disclosed Plugin4Shell on September 17, 2026, a plugin supply-chain vulnerability affecting major AI coding agents. The flaw can defeat commit-SHA pinning used to keep an installed marketplace plugin on reviewed code, allowing attacker-controlled plugin code to run with the local privileges available to the coding agent under the demonstrated conditions.

Two affected clients already have fixed releases: Anthropic Claude Code 2.1.179 or later and OpenAI Codex 0.146.0 or later. Air says GitHub Copilot had no client fix at public disclosure. Google told the researchers that the deprecated Gemini CLI would receive no fix and directed users toward Antigravity.

The practical response depends on the client. Claude Code and Codex users should verify their installed versions and update where necessary. Organizations using Copilot plugin marketplaces should reduce plugin-update exposure while awaiting a complete client-side fix. Existing Gemini CLI deployments that use marketplace plugins should be migrated away from the deprecated client.

Plugin4Shell status by coding agent

Coding agent Status at disclosure Minimum fixed version / action
Anthropic Claude Code Patched 2.1.179 or later
OpenAI Codex Patched 0.146.0 or later
GitHub Copilot No complete client fix reported by Air Restrict marketplace/plugin exposure and monitor vendor guidance
Google Gemini CLI Deprecated; no fix planned Migrate to Antigravity, per the research disclosure

Air says it found the issue in May, disclosed it to the affected vendors in June, and verified the Claude Code fix on June 17 and the Codex fix on August 12. The research became public on September 17.

What the vulnerability breaks

Plugin marketplaces can pin a plugin to a Git commit SHA so that a reviewed version remains tied to immutable source code. Air's research found that the affected clients could perform a checkout without subsequently confirming that the resulting checkout actually matched the expected commit.

That missing verification creates a supply-chain boundary failure. An attacker who controls the relevant plugin repository can, under the demonstrated repository conditions, cause the client to obtain different code while the marketplace still presents the expected pin. The plugin then executes inside the developer environment with the permissions available to the agent process.

The researchers demonstrated the issue across Claude Code, Codex, GitHub Copilot and Gemini CLI. Gemini CLI reaches the same security outcome through a different Git reference-resolution path from the other three clients.

Why background updates raise the impact

Air describes Plugin4Shell as zero-click because plugin refreshes can occur after the original installation. Claude Code and Codex can automatically update plugins from their built-in marketplaces, allowing an already-installed plugin to receive changed upstream content without a new installation approval.

This makes repository ownership part of the trust chain after marketplace review. A malicious plugin author could submit benign code and alter the repository later, or an attacker could take control of a legitimate plugin repository. The SHA pin is intended to contain that class of upstream change; Plugin4Shell undermines the containment when the client fails to verify the final checkout.

The exposure is narrower than arbitrary remote compromise of every coding-agent installation. It depends on marketplace-plugin use, repository control and the affected checkout/update path. Repository hosting also matters: GitHub says it rejects branch or tag names that resemble full commit SHAs, which blocks the demonstrated hash-shaped-reference variant on GitHub-hosted repositories. Air notes that other supported Git hosts and self-hosted Git services can permit the relevant naming behavior, and the Gemini CLI variant uses a different reference condition.

Claude Code: update to 2.1.179 or later

Air says Anthropic fixed the issue in Claude Code 2.1.179, confirmed on June 17. Administrators should inventory Claude Code versions on developer workstations and CI environments that use plugins, then move older installations to a current supported build.

Version remediation is the durable control because the security check belongs in the client that resolves and checks out the pinned plugin. Marketplace review alone cannot verify what an affected client ultimately placed in its working tree.

OpenAI Codex: update to 0.146.0 or later

Air verified Codex 0.146.0 as fixed on August 12. Codex users running older versions should update before relying on marketplace SHA pins as the integrity boundary for plugin updates.

For managed developer fleets, the relevant inventory includes local Codex installations as well as persistent CI or automation hosts where a coding agent may have access to source repositories, environment variables, developer credentials or deployment tooling.

Copilot: treat third-party marketplace updates as an open risk

Air reported no complete GitHub Copilot client fix at disclosure. GitHub told The Hacker News and The Register that GitHub itself prevents SHA-like branch and tag names, limiting the demonstrated variant for marketplaces whose plugin repositories are hosted on GitHub.

That hosting restriction reduces exposure for those repositories, while the client-side verification gap remains relevant to plugin sources on Git hosts that allow the conflicting reference form. Organizations should prefer tightly controlled plugin sources, limit automatic or unattended marketplace changes where configuration permits, and follow Microsoft's and GitHub's current security guidance for a client fix.

Gemini CLI: migration is the remediation path

According to Air, Google said on August 4 that Gemini CLI is deprecated and will not receive a Plugin4Shell fix. The researchers report that Google recommends migration to Antigravity, whose plugin architecture does not use the affected marketplace SHA-pinning mechanism.

Organizations retaining Gemini CLI should prioritize migration where marketplace plugins are in use. Removing unused plugins and reducing repository trust are useful exposure-reduction steps during the transition, while migration removes reliance on the affected deprecated client.

What security teams should check

Start with an inventory of coding-agent clients and their plugin use. Claude Code installations below 2.1.179 and Codex installations below 0.146.0 should be upgraded. Copilot and Gemini CLI require separate treatment because the disclosure does not provide equivalent fixed client versions.

Then review the plugin trust chain: which marketplaces are enabled, where plugin repositories are hosted, whether updates run unattended, and which credentials or local resources the agent process can reach. Developer machines commonly hold source-code access, package-registry credentials, SSH material and cloud or deployment tokens, making agent-process privileges important to incident scope.

For environments that used affected clients with marketplace plugins, preserve relevant plugin/update logs and investigate unexpected plugin revisions or repository ownership changes. Rotate credentials when there is evidence that untrusted plugin code executed with access to them.

Exploitation status and evidence boundary

Air's publication documents working proof-of-concept exploitation during research and a coordinated disclosure process. The reviewed sources do not report confirmed in-the-wild exploitation of Plugin4Shell before public disclosure.

The affected-client status comes primarily from Air's coordinated-disclosure account. Independent reporting from The Hacker News, The Register and Help Net Security corroborates the fixed Claude Code and Codex versions, the unresolved Copilot status at disclosure, Google's Gemini CLI migration position and the repository-hosting qualification raised by GitHub.

Bottom line

Plugin4Shell exposes a real integrity gap in plugin SHA pinning across four major AI coding-agent ecosystems. Claude Code 2.1.179 and Codex 0.146.0 contain fixes. GitHub Copilot lacked a complete client fix at disclosure, while deprecated Gemini CLI is being handled through migration rather than a patched release.

For developer fleets, the immediate priority is version inventory, upgrading Claude Code and Codex, constraining unresolved plugin-update paths, and migrating Gemini CLI deployments that depend on marketplace plugins. The broader control is straightforward: a coding agent should verify that the code checked out for a pinned plugin actually resolves to the pinned commit before executing it.

Sources

Continue reading

Artificial Intelligence Claude Fable 5.1 and Mythos 5.1: Pricing, Benchmarks, Access and Technical Changes

Anthropic has released Claude Fable 5.1 and restricted-access Mythos 5.1. Here are the API prices, cache-read change, benchmark results, safeguards and availability.

Artificial Intelligence Broadcom AgentMinder Is Now Generally Available for AI Agent Governance and Runtime Control

Broadcom launched AgentMinder at VMware Explore 2026 as a generally available control layer for AI agents, with identity, intent-based authorization, runtime policy enforcement, OpenTelemetry auditability and Kubernetes deployment support.

Cybersecurity Cybersecurity AI Skills in 2026: What the Agentic Shift Changes

Cisco-led workforce research shows AI skills spreading rapidly through cybersecurity roles. Here is what practitioners should learn, prove and prioritize without abandoning core security depth.