Plugin Pinning Failure Exposes AI Coding Agents to Silent Supply-Chain Swaps

A repository owner can bypass plugin version locks in four widely used AI coding agents, causing them to install unreviewed code while continuing to display the expected version.

The supply-chain vulnerability, named Plugin4Shell by Air Security, affects Anthropic Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI. Air successfully tested the attack against all four products in May and notified their vendors in June.

Anthropic and OpenAI have released corrections. GitHub Copilot remains unpatched, according to Air, while Google does not plan to fix the retiring Gemini CLI. No CVE or vendor security advisory had been published as of September 18, 2026, and there was no evidence of exploitation in real-world attacks.

A pinned commit does not guarantee pinned code

AI coding agents can extend their capabilities by downloading plugins from marketplaces and external source-code repositories. To prevent code from changing after review, a marketplace can identify each approved plugin using a Git commit hash.

That hash should represent one immutable repository snapshot. In the affected agents, however, the installation process does not adequately verify that the downloaded content corresponds to the specified commit.

Plugin4Shell exploits ambiguity in the way Git resolves references. On a repository service that permits it, an owner can create a branch with a name resembling the plugin’s locked commit hash. The attacker then points that branch at a different commit containing malicious code.

When the agent requests what it believes is the approved commit, Git may interpret the value as the attacker-controlled branch name. The installer consequently retrieves code from another commit, but the agent still reports the plugin as being at its expected, pinned version.

This defeats both review and version transparency. A plugin can appear unchanged to the user even though its executable contents have been replaced.

OpenAI’s public change for Codex describes the same failure mode: Git may treat a requested commit SHA as a branch reference, allowing a plugin source to resolve to a commit other than the one recorded in the lock. The correction is included in Codex 0.146.0.

Exploitation depends on the repository host

The hash-shaped branch technique does not work uniformly across hosting platforms. GitHub prohibits branch and tag names that resemble commit hashes, blocking this specific method for repositories hosted there.

Air found the attack effective on Bitbucket and privately operated Git servers, which may permit those names. The affected coding agents support plugins from such external repositories.

This distinction substantially narrows exposure for users who rely only on default marketplaces. A review of the agents’ catalogs and the underlying vulnerability on September 18 found that Anthropic’s community catalog and the default Claude Code and Copilot catalogs referenced GitHub repositories.

However, GitHub hosting is not a general fix for the defective validation logic. Copilot, for example, can install plugins from repositories outside GitHub. Users who add a Bitbucket repository, a private Git server, or another host permitting ambiguous reference names remain exposed while using an unpatched agent.

Gemini CLI also has a separate repository-resolution problem. According to Air, its installer can be influenced by a repository whose main branch is named FETCH_HEAD. GitHub’s documented restriction on hash-like names does not clearly exclude FETCH_HEAD, so GitHub-hosted Gemini CLI plugins cannot be treated as definitively safe from that variant.

Automatic updates can remove the need for another prompt

The highest-risk configuration is one in which an agent updates an already trusted plugin in the background. Once users approve the initial installation, a repository owner could change what an ambiguous reference resolves to and deliver replacement code without another confirmation.

Air reported that background plugin updates are enabled by default in Claude Code and Codex. That does not mean every default installation is immediately exposed, however.

Automatic updates are enabled by default only for the products’ built-in marketplaces, which are hosted on GitHub. Documentation from Anthropic and GitHub indicates that updating from external marketplaces is disabled or optional. GitHub’s naming rules therefore block the principal hash-shaped branch technique in those default catalogs.

The danger grows when organizations configure private marketplaces or install plugins directly from supported non-GitHub repositories. A marketplace operator cannot repair already deployed agents because reference validation occurs on each user’s machine. The agent itself must confirm that the retrieved object is the exact locked commit.

Fixes differ sharply across the four agents

Product	Current status	Recommended response
Anthropic Claude Code	Air says the issue is fixed in 2.1.179	Upgrade to version 2.1.179 or later
OpenAI Codex	Fixed in 0.146.0	Upgrade to version 0.146.0 or later
GitHub Copilot	No fix has shipped, according to Air	Avoid plugins from untrusted external repository hosts
Google Gemini CLI	Google does not plan to fix the retiring product	Migrate to Antigravity where possible

Anthropic’s release notes for Claude Code 2.1.179 do not identify Plugin4Shell. The claim that this version resolves the issue comes from Air’s assessment. OpenAI, by contrast, publicly documented the relevant Git reference-resolution correction.

Air said it informed Microsoft in June, but no corresponding Copilot update had been released. Until that changes, Copilot users should treat plugins hosted on Bitbucket, private Git servers, and similar services as potentially vulnerable.

Google stopped serving the consumer Gemini CLI in June and has directed users toward Antigravity. Air said Antigravity is not susceptible to this attack. Google has stated that enterprise access to Gemini CLI will continue receiving updates, although it is not known whether those updates will correct Plugin4Shell.

Malicious plugins inherit the user’s access

A substituted plugin executes with the privileges available to the person running the coding agent. Its practical reach therefore depends on local permissions, stored secrets, agent configuration, and authenticated sessions.

Potential consequences include reading source code and local files, extracting saved credentials, and accessing development or business systems available through the user’s existing authentication. Developer workstations are particularly sensitive because they often combine repository access, cloud credentials, signing material, and internal network connectivity.

No confirmed compromises or active exploitation campaigns were known as of September 18, 2026. No CVE identifier had been assigned, and none of the four vendors had released a dedicated security advisory.

Plugin4Shell nevertheless demonstrates that a displayed version is not proof of the installed code’s identity. The lock is meaningful only if the installer verifies the resulting Git object rather than trusting name resolution.

Existing installations require separate inspection

Upgrading Claude Code or Codex should prevent future substitutions, but available information does not establish whether either update detects or removes plugins that were previously replaced. Organizations should therefore treat remediation and retrospective inspection as separate tasks.

Administrators and developers should:

• Upgrade Claude Code to 2.1.179 or later.
• Upgrade Codex to 0.146.0 or later.
• Avoid external Copilot plugin sources until GitHub ships a fix.
• Migrate from Gemini CLI to Antigravity where operationally possible.
• Independently compare installed plugin contents with the trusted repository commit.
• Review plugins installed before the agent was upgraded, rather than assuming the patch cleans them up.
• Restrict plugin access to files, credentials, tokens, and authenticated systems.
• Examine plugin repositories and update activity for unexplained reference changes.
• Monitor credentials and connected services for unexpected access after suspicious plugin updates.

Users can reduce exposure by preferring the agents’ default GitHub-hosted catalogs, where the documented naming restriction blocks the hash-shaped branch attack. That protection is conditional, particularly for Gemini CLI because of the FETCH_HEAD variant.

The durable remedy is stricter client-side validation: after retrieval, the agent must establish that the installed source resolves to the exact commit recorded by the marketplace or lock file. Anything less leaves a gap between the version shown to the user and the code that actually runs.