Researchers at the security startup Air disclosed Plugin4Shell on 17 September, a zero-click remote code execution flaw in the way four AI coding agents install plugins from marketplaces: Anthropic’s Claude Code, OpenAI’s Codex, Google’s Gemini CLI and GitHub Copilot.1 The Register 2026-09-17 Air disclosed Plugin4Shell on 17 Sep 2026; agents never verify the pinned checkout; Claude Code 2.1.179 and Codex 0.146.0 patched; Gemini CLI deprecated and unpatched; Copilot unfixed; reported in June; auto update makes it zero-click. Open source The agents ask Git for the commit a marketplace pinned but never confirm that the code on disk is that commit, so an attacker who controls a plugin repository can serve different code while the pin appears honored.1 The Register 2026-09-17 Air disclosed Plugin4Shell on 17 Sep 2026; agents never verify the pinned checkout; Claude Code 2.1.179 and Codex 0.146.0 patched; Gemini CLI deprecated and unpatched; Copilot unfixed; reported in June; auto update makes it zero-click. Open source 2 CSO Online 2026-09-18 Found in May, disclosed in June; a ref named like the trusted SHA resolves to malicious code; Gemini CLI exposed via FETCH_HEAD; GitHub blocks SHA-like ref names on its own platform; analyst Pareekh Jain says plugins run with developer access. Open source Anthropic and OpenAI have shipped fixes; Google says it will not patch the deprecated Gemini CLI, and Copilot had no fix at disclosure.1 The Register 2026-09-17 Air disclosed Plugin4Shell on 17 Sep 2026; agents never verify the pinned checkout; Claude Code 2.1.179 and Codex 0.146.0 patched; Gemini CLI deprecated and unpatched; Copilot unfixed; reported in June; auto update makes it zero-click. Open source We assess with high confidence that the significance lies less in this bug than in what it shows: the trust model of agent plugin ecosystems was built on an integrity check that nobody verified, and the agents carrying it run with the developer’s full access.

How a pin stopped meaning anything

A marketplace that reviews a plugin records the commit hash it approved, and the agent is supposed to install exactly that commit. The flaw sits in the step between. In Claude Code, Codex and Copilot, the agent clones the repository and then checks out the pinned hash by name, and Git, by documented behavior, will resolve a branch whose name is a 40 character hex string before it treats that string as a commit id.3 Let’s Data Science 2026-09-18 Researchers Or Nevo, Dor Granat and Niv Hoffman; a branch named like a 40 character SHA wins; auto update on by default in Claude Code and Codex; plugins run with the developer’s OS permissions. Open source An attacker who creates a branch named after the trusted hash therefore gets the malicious branch checked out instead.2 CSO Online 2026-09-18 Found in May, disclosed in June; a ref named like the trusted SHA resolves to malicious code; Gemini CLI exposed via FETCH_HEAD; GitHub blocks SHA-like ref names on its own platform; analyst Pareekh Jain says plugins run with developer access. Open source 3 Let’s Data Science 2026-09-18 Researchers Or Nevo, Dor Granat and Niv Hoffman; a branch named like a 40 character SHA wins; auto update on by default in Claude Code and Codex; plugins run with the developer’s OS permissions. Open source Gemini CLI fails slightly differently: it checks out FETCH_HEAD after fetching, so a ref named FETCH_HEAD wins.2 CSO Online 2026-09-18 Found in May, disclosed in June; a ref named like the trusted SHA resolves to malicious code; Gemini CLI exposed via FETCH_HEAD; GitHub blocks SHA-like ref names on its own platform; analyst Pareekh Jain says plugins run with developer access. Open source

Two features turn this from a curiosity into a zero-click attack. Plugins update in the background, and auto update is on by default in Claude Code and Codex, so a swapped payload installs itself without the user doing anything.3 Let’s Data Science 2026-09-18 Researchers Or Nevo, Dor Granat and Niv Hoffman; a branch named like a 40 character SHA wins; auto update on by default in Claude Code and Codex; plugins run with the developer’s OS permissions. Open source And plugins commonly run with the developer’s operating system permissions, which on a working engineer’s machine means source code, cloud credentials and CI pipelines.2 CSO Online 2026-09-18 Found in May, disclosed in June; a ref named like the trusted SHA resolves to malicious code; Gemini CLI exposed via FETCH_HEAD; GitHub blocks SHA-like ref names on its own platform; analyst Pareekh Jain says plugins run with developer access. Open source 3 Let’s Data Science 2026-09-18 Researchers Or Nevo, Dor Granat and Niv Hoffman; a branch named like a 40 character SHA wins; auto update on by default in Claude Code and Codex; plugins run with the developer’s OS permissions. Open source Air describes the attack paths as getting a benign plugin approved and later swapping in hostile code, or taking over a legitimate author’s repository, which its earlier repository hijacking proofs of concept had demonstrated.1 The Register 2026-09-17 Air disclosed Plugin4Shell on 17 Sep 2026; agents never verify the pinned checkout; Claude Code 2.1.179 and Codex 0.146.0 patched; Gemini CLI deprecated and unpatched; Copilot unfixed; reported in June; auto update makes it zero-click. Open source

The disclosure record is the second story

Air says it found the flaw in May and reported it to all four vendors in June.2 CSO Online 2026-09-18 Found in May, disclosed in June; a ref named like the trusted SHA resolves to malicious code; Gemini CLI exposed via FETCH_HEAD; GitHub blocks SHA-like ref names on its own platform; analyst Pareekh Jain says plugins run with developer access. Open source The responses split cleanly. Anthropic fixed Claude Code in version 2.1.179 and OpenAI fixed Codex in version 0.146.0.1 The Register 2026-09-17 Air disclosed Plugin4Shell on 17 Sep 2026; agents never verify the pinned checkout; Claude Code 2.1.179 and Codex 0.146.0 patched; Gemini CLI deprecated and unpatched; Copilot unfixed; reported in June; auto update makes it zero-click. Open source Google told Air that Gemini CLI is deprecated, that it will not issue a fix, and that users should move to its Antigravity environment, which it says is not affected.1 The Register 2026-09-17 Air disclosed Plugin4Shell on 17 Sep 2026; agents never verify the pinned checkout; Claude Code 2.1.179 and Codex 0.146.0 patched; Gemini CLI deprecated and unpatched; Copilot unfixed; reported in June; auto update makes it zero-click. Open source 2 CSO Online 2026-09-18 Found in May, disclosed in June; a ref named like the trusted SHA resolves to malicious code; Gemini CLI exposed via FETCH_HEAD; GitHub blocks SHA-like ref names on its own platform; analyst Pareekh Jain says plugins run with developer access. Open source Microsoft had not fixed Copilot and, per Air, never responded to the June report; GitHub’s position is that it already blocks branch and tag names that resemble commit hashes on its own platform.1 The Register 2026-09-17 Air disclosed Plugin4Shell on 17 Sep 2026; agents never verify the pinned checkout; Claude Code 2.1.179 and Codex 0.146.0 patched; Gemini CLI deprecated and unpatched; Copilot unfixed; reported in June; auto update makes it zero-click. Open source Air’s rebuttal is that Copilot also supports marketplaces hosted on Bitbucket or self hosted Git servers, where GitHub’s rule does not apply.2 CSO Online 2026-09-18 Found in May, disclosed in June; a ref named like the trusted SHA resolves to malicious code; Gemini CLI exposed via FETCH_HEAD; GitHub blocks SHA-like ref names on its own platform; analyst Pareekh Jain says plugins run with developer access. Open source 3 Let’s Data Science 2026-09-18 Researchers Or Nevo, Dor Granat and Niv Hoffman; a branch named like a 40 character SHA wins; auto update on by default in Claude Code and Codex; plugins run with the developer’s OS permissions. Open source

The GitHub answer is technically narrow and strategically revealing. It treats the problem as a hosting policy rather than an agent defect, which protects the default path and leaves every other path to the customer. A deprecation that leaves existing installs vulnerable makes the same move from the other direction: Google is pricing the cost of a patch against the cost of migration and choosing migration.

Who gains and who loses

The vendors that patched before disclosure gain a credible security story at the moment enterprises are deciding which agents to allow on developer machines. Security teams gain a concrete artifact to justify inventorying plugins, which most organizations do not yet track. Air, a young firm, gains the kind of named, multi vendor finding that builds a research brand.

Copilot users on non GitHub marketplaces lose most, because the mitigation their vendor offers does not reach them. Gemini CLI holdouts lose a supported tool. Third party plugin marketplaces lose on two counts: the analyst Pareekh Jain told CSO that a marketplace cannot fix a flaw in how the agent validates what it checks out, so marketplaces carry reputational risk for a defect they cannot repair.2 CSO Online 2026-09-18 Found in May, disclosed in June; a ref named like the trusted SHA resolves to malicious code; Gemini CLI exposed via FETCH_HEAD; GitHub blocks SHA-like ref names on its own platform; analyst Pareekh Jain says plugins run with developer access. Open source

The counter case

The strongest argument against treating this as serious is that the attack still needs control of a plugin repository, and that the default catalogues mostly point at GitHub, where the hosting rule closes the obvious path. If exploitation requires a compromised author or a malicious plugin that passed review, the practical exposure is narrower than the zero-click label suggests. That argument holds for today’s small plugin ecosystems. It weakens as agents add marketplaces, auto update by default and accumulate credentials, which is the direction every vendor is moving.

What to watch

  • Copilot will be the laggard. Anthropic and OpenAI appear to have patched quietly months ago. We expect GitHub to be the last of the three to confirm a client fix, and possibly to say nothing within the month.
  • No CVE, no exploitation. Our read: this ends without a CVE number or a confirmed attack in the wild. That keeps it a research disclosure rather than an incident, which suits all three vendors.

What happened next (updated Oct 13, 2026)

This section was added after publication. A review published on 20 September found that the Claude Code fix had shipped on 16 June and the Codex fix on 29 July, months before disclosure; it found no GitHub statement of a Copilot fix dated on or before 20 September, and no CVE identifier and no reported exploitation in the wild.4 Digital Applied 2026-09-20 Claude Code fix shipped 16 Jun, Codex fix 29 Jul; no Copilot fix statement found by 20 Sep; no CVE assigned and no exploitation in the wild reported. Open source We found no later reporting of a Copilot client fix through 13 October.