A zero-click vulnerability affecting the four largest AI coding agents left two of them without a fix this week. The flaw, named Plugin4Shell by the security firm Air, broke the plugin supply chain model used by Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot and Google’s Gemini CLI. Anthropic and OpenAI shipped patches. GitHub says its platform already blocks exploitation, and Google declined to patch Gemini CLI because it has deprecated the tool.
How the attack works
Each of the four agents lets users install plugins from marketplaces, and each marketplace pins a plugin to a specific reviewed commit using a 40-character git SHA. The pin is supposed to guarantee that the code running on a developer’s machine matches the code that passed review. Plugin4Shell breaks that guarantee at the git layer.
Git resolves a named reference before a raw object ID. So if an attacker controls a plugin’s repository, they can create a branch whose name is the same 40-hex string as the pinned SHA. When the agent’s installer runs git checkout, git checks out the branch, not the commit. The agent reports a clean install of the reviewed version while actually running whatever the branch points to. On Bitbucket and self-hosted Git servers, which allow branch names shaped like commit hashes, the swap goes through. GitHub rejects that branch-name shape, which is why GitHub says its host-side check already prevents exploitation of its own Copilot users.
The second stage is what makes it dangerous. Claude Code and Codex update installed plugins automatically by default, so a repository owner who swaps the content under a reviewed SHA pushes the malicious version out to every installed agent with no click from the user. Air researchers Or Nevo, Dor Granat and Niv Hoffman called it a first-of-its-kind AI supply chain attack, and they warned it could reach millions of machines. Roughly 90 percent of Fortune 500 companies use Copilot, by Microsoft’s own count, which is one reason the disclosure drew attention well beyond the security press.
| Agent | Status | Detail |
|---|---|---|
| Claude Code | Patched | Fixed in 2.1.179 |
| OpenAI Codex | Patched | Fixed in 0.146.0 |
| GitHub Copilot | No patch shipped | GitHub says host-side branch block prevents it |
| Gemini CLI | Will not be patched | Deprecated; users pointed to Antigravity |
Two attack scenarios
Air described two ways to abuse the flaw. In the first, an attacker submits a benign plugin to a trusted marketplace, waits for it to pass review, and later replaces the reviewed content with malicious code. In the second, the attacker hijacks a legitimate author’s repository and pushes the malicious version onto every agent that has the plugin installed. Both end the same way: full access to everything the agent can reach, which for most developers means the entire codebase, credentials in environment files and any systems the agent’s tools touch. An agent that has been granted shell access, API keys and deployment permissions in the name of productivity is, once compromised, an attacker sitting inside the build pipeline.
The Register’s coverage summed up the researchers’ warning: the flaw could hand attackers the keys to the kingdom. The fix has to ship in the agent itself, and updating is the only complete mitigation where one exists.
The patch gap
Air reported the issue to all four vendors in June. Anthropic patched Claude Code in version 2.1.179, and OpenAI followed with Codex 0.146.0, whose commit message was pointedly titled “Verify Git plugin SHA checkouts.” Microsoft has not shipped a fix for Copilot; the disclosure notes that Microsoft received the report in June and that no mitigation exists beyond removing plugins entirely until a patch lands. Google told Air it will not patch Gemini CLI at all. The company deprecated the CLI for consumer accounts in June in favor of the Antigravity agent, which does not use the same plugin SHA-pinning model, and advised users to migrate. Enterprise Code Assist customers still receiving Gemini CLI builds remain exposed, and anyone who installed plugins through the CLI before deprecation has no automatic path to safety.
No CVE had been assigned to the flaw as of this week, which security researchers noted is unusual for an issue of this scope and complicates corporate tracking of exposure. Security teams that manage vulnerability inventories by CVE number have no clean record to query, so the practical detection method remains the manual audit Air published: check whether each plugin checkout is a detached HEAD at the pinned SHA rather than sitting on a named branch.
Part of a pattern
Plugin4Shell is the second major agent security story this month. Earlier in September, Manifold Security disclosed a set of flaws, published as GitSpawn, in which a repository’s own git configuration names a command the agent runs at session startup. On several agents the payload fired before the workspace-trust prompt appeared, and fixes for a second Claude Code path and for several smaller agents were still pending when Manifold retested in early September. Goose, Codex CLI and Cursor shipped fixes in that round; Hermes Agent, Qwen Code and Grok Build were still executing repository-supplied commands at the time of the report.
Together the two disclosures mark a shift in attacker focus: away from the models and their prompts, toward the ordinary plumbing underneath the agents, the git operations and plugin installers that nobody audits as closely as the model itself. The Manifold researchers put it plainly. The vulnerability is not in the model, or in anything new. It is in the subprocess an agent spawns at session startup to work out where it is.
For teams running coding agents on production repositories, the practical checklist is short. Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Audit installed plugins using the detached-HEAD check above. Treat plugin marketplaces as untrusted inputs rather than reviewed sources, and disable auto-updates for anything business-critical. For agents still unpatched, the only real mitigation is removing the plugin system until the vendor ships. The June-to-September gap between disclosure and patch coverage is itself the lesson: the supply chain for AI agent tooling is young, and the review processes around it are younger.