Air Security says four AI coding agents shared one plugin flaw, and Copilot and Gemini CLI still have no fix

Air Security, a research lab backed by Sequoia Capital, published on 18 September a coordinated disclosure it calls Plugin4Shell: one zero-click remote code execution flaw that shipped in the plugin systems of Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI and Microsoft's GitHub Copilot at the same time. The Information reported the finding first.

The writeup names the researchers as Or Nevo, Dor Granat and Niv Hoffman. Air Security says the team had working proofs of concept against all four agents in May 2026 and disclosed to each vendor in June.

What the flaw is

Every one of the four agents lets users pin a plugin to a specific commit SHA. Air Security says none of them verified that the checkout landed on that commit. In three of the four, an attacker who controls the plugin's repository can create a branch whose name is the same string as the pinned SHA and set it as the default branch. Git prefers the branch reference over the commit object, so the checkout resolves to attacker-controlled code while the pin still looks intact. In Gemini CLI the same result comes from a separate path: the fetched commit is never validated, so a repository whose default branch is named FETCH_HEAD swaps in whatever that branch points at.

Air Security calls this zero-click because Claude Code and Codex re-run the same checkout on their default background auto-update. Once a marketplace bumps the pinned SHA, the swap reaches installed plugins with no user step.

What is and is not patched

According to Air Security's timeline, Anthropic shipped a fix in Claude Code 2.1.179 on 17 June, and OpenAI shipped a fix in Codex 0.146.0 on 12 August. Microsoft has not shipped a fix for GitHub Copilot. Google has retired Gemini CLI without patching it, so every existing install stays exposed and there will be no vendor update.

The company argues that marketplace-side fixes cannot close the gap on their own: an attacker still controls the source repository the agent fetches from, so a client that does not verify the checkout will accept whatever git resolves the pin to. The correct place to patch is inside each agent.

What to do this week

Two of the four agents have a version to move to. For Claude Code, the recorded patch line is 2.1.179 or newer; the latest stable release at the time of writing is 2.1.275. For Codex, the recorded patch line is 0.146.0 or newer; the latest release is 0.155.0. Check the pinned version your team is actually running, since a locked older tag is common.

For GitHub Copilot and Gemini CLI, there is no patch to install. Treat third-party plugins as untrusted code: audit which plugins are enabled, disable ones that are not necessary for the team's daily work, restrict what those environments can reach on the network, and rotate any credentials a compromised agent could have read. Gemini CLI is already deprecated and will not get another update, so the honest question is whether to keep it in the workflow at all.

The wider point for a team building software is that "pinned to a SHA" has been treated as a security statement for years, and this disclosure shows four teams in a row shipping a client that did not check the pin held. When an agent auto-updates plugins in the background, the code the agent fetches has the same level of access as the code your engineers write.

Source

• Primary: Plugin4Shell writeup, Air Security (18 September 2026)
• Coverage: Help Net Security and The Information