Plugin4Shell: A Git Naming Trick Let Attackers Swap Code in Four AI Coding Agents
On September 18, 2026, security researchers at Air Security disclosed Plugin4Shell — a zero-click vulnerability in the plugin systems of four major AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. The flaw lets an attacker who controls a plugin's source repository swap in malicious code even though the agent believes it installed the exact, reviewed version it asked for — and because these agents auto-update plugins in the background, the swap can happen without the user clicking anything at all.
The promise a "pinned" plugin makes
When you install a plugin from an agent's marketplace, the marketplace doesn't just point at a repository — it pins the plugin to one exact commit, identified by its SHA, a 40-character fingerprint of that specific snapshot of code. The idea is simple: whatever gets reviewed and approved is the only thing that can ever be installed under that name. Even if the plugin's author changes the code later, or an attacker takes over the repository, the agent should still fetch and run that one frozen commit.
That guarantee only holds if the agent actually double-checks that the code it ends up with matches the SHA it asked for.
How the swap works
According to Air Security's research, none of the four agents performed that final check. Instead, each ran a git checkout of the pinned SHA and simply trusted that it landed in the right place.
For Claude Code, Codex, and GitHub Copilot, the trick is a naming collision: an attacker who controls the plugin's repository creates a branch whose name is identical to the 40-character commit hash the marketplace has pinned. Git, when asked to check out a string that could be either a branch name or a commit ID, gives priority to the matching branch reference — so the agent checks out the attacker's branch instead of the actual pinned commit, while still believing it got the right one.
Gemini CLI's variant works differently but hits the same weak spot: its plugin installer fetches the pinned commit, then runs git checkout FETCH_HEAD. An attacker who names a branch FETCH_HEAD can redirect that checkout to their own malicious content instead of the commit that was just fetched.
Researchers noted the exploit isn't universal — GitHub itself rejects branch names that look like commit hashes, which blocks the trick there. Bitbucket and self-hosted git servers impose no such restriction, leaving them exploitable.
Why zero clicks matters
The reason this is more than a theoretical footnote is auto-update. Claude Code and Codex refresh installed plugins in the background by default. That means an attacker doesn't need to trick anyone into installing a new plugin — they only need to get a legitimate-looking plugin adopted once, then either modify the repository they still control or compromise the original maintainer's account later. The next silent auto-update does the rest, handing the swapped-in code the same file and shell access the agent already had.
What happened next
Air Security says it found working proof-of-concept exploits in May 2026 and disclosed the flaw to all four vendors in June. Anthropic shipped a fix in Claude Code 2.1.179, confirmed in mid-June, and OpenAI patched Codex in version 0.146.0, verified in August. GitHub has not shipped a fix for Copilot as of disclosure. Google, rather than patching Gemini CLI, has deprecated the product outright without correcting the underlying flaw. Researchers described it as the first supply-chain vulnerability specific to the AI coding-agent ecosystem, and said no in-the-wild exploitation, breach, or data loss has been reported.
Why it matters
This isn't a story about one buggy plugin — it's a reminder that "pinning" only protects you if the software checking the pin actually verifies what it received, not just what it asked for. As coding agents lean harder on plugin ecosystems for extra tools and integrations, the trust chain between "the marketplace says this is safe" and "the code that actually ran on your machine" needs its own verification step, every single link. If you use Copilot or the now-deprecated Gemini CLI with third-party plugins, treat auto-update as a live risk until a fix lands, and prefer plugins hosted on platforms — like GitHub — that block the naming trick outright.
This explainer was made with LineLapse — type a topic, get a hand-drawn video. Make your own →