Security Flaw Lets Attackers Silently Hijack AI Coding Agents via Plugin Updates
Air Security researchers Or Nevo, Dor Granat, and Niv Hoffman disclosed a zero-click remote code execution vulnerability on Sept. 17, 2026, affecting Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. The researchers named it Plugin4Shell.
The flaw sits in how each agent installs plugins from a marketplace. The standard safeguard is SHA pinning: a reviewer approves a plugin at a specific commit, and the agent is supposed to run only that exact version. Air Security found that none of the four agents verify the checkout actually resolved to the pinned commit. An attacker who controls a plugin's repository can create a branch whose name matches the pinned SHA, set it as the repo's default, and the agent's checkout resolves to the attacker's branch instead. The Gemini CLI variant works differently, exploiting a similar gap in how the CLI handles FETCH_HEAD, but the missing check is the same in both cases.
What makes it zero-click is background auto-update. Claude Code and Codex update installed plugins automatically by default, so a plugin a user already trusts can be replaced with a malicious version without any user action when the marketplace bumps the pinned version.
As of the Sept. 17 disclosure, Anthropic had patched the flaw in Claude Code 2.1.179, confirmed June 17, 2026. OpenAI confirmed a fix in Codex 0.146.0, verified Aug. 12, 2026. Microsoft had not shipped a fix for GitHub Copilot as of disclosure. Google will not patch Gemini CLI, which the company has deprecated; all installations remain vulnerable.
Air Security described the fix as an assertion that must run inside the agent after checkout: confirming the resolved commit matches the pinned SHA before execution. Because the pin is checked on the client, no marketplace change can enforce the guarantee.
Anyone running Claude Code or Codex should confirm they are on the patched versions. GitHub Copilot users have no patch available as of disclosure on Sept. 17, 2026. Gemini CLI should be replaced; no fix will be issued for the deprecated tool.
