Zero-click flaw lets repo owners swap pinned plugins across four AI coding agents

Security researchers at Air Security disclosed a vulnerability on September 18 that lets anyone controlling a plugin's source repository silently swap the code an AI coding agent installs — even when that agent has "pinned" the plugin to a specific, previously reviewed commit hash. The flaw, dubbed Plugin4Shell, affects five agent products from four companies: Anthropic's Claude Code, OpenAI's Codex, Google's Gemini CLI, Microsoft Copilot, and GitHub Copilot.

How the pin gets defeated

The bug exploits an obscure quirk in how Git resolves references: it can interpret a requested commit SHA as a branch name if no matching commit exists locally. AI coding agents lock plugins to specific commit hashes as a security measure, intending to guarantee that whatever code was reviewed is the exact code that gets installed later. But because the agents never verify that the fetched content actually matches the pinned hash byte-for-byte, an attacker who controls the plugin's repository can create a branch named after the pinned commit hash and point that branch at entirely different, malicious code. The agent reports that it installed the locked, reviewed version — while it actually pulled whatever the attacker put behind that branch name. Air Security calls it zero-click because no user interaction beyond a normal plugin install is required to trigger it.

There's an important limitation: GitHub itself blocks branch names that resemble commit hashes, so plugins hosted directly on GitHub are not exploitable this way. The attack works against plugins hosted on alternative git hosts, such as Bitbucket or self-hosted git servers, which are common in enterprise and open-source plugin ecosystems that don't require GitHub specifically.

A five-month disclosure window, then a split response

Air Security built working proof-of-concept attacks against all four affected agent platforms in May 2026 and notified the vendors in June, giving them roughly three months before public disclosure on September 18. The vendor responses diverged sharply in that window. Anthropic shipped a fix in Claude Code version 2.1.179, and OpenAI patched Codex in version 0.146.0 — both citing the Git SHA-as-branch-name behavior directly in their fix documentation. Microsoft, notified of the identical flaw affecting Copilot, has not shipped a patch as of this week, leaving existing installations exposed with no fix available. Google went further in the opposite direction: rather than patch Gemini CLI, the company is retiring the product entirely and directing users toward a separate tool called Antigravity, which means every existing Gemini CLI installation remains permanently vulnerable with no update path.

Why the split matters more than the bug itself

Individual Git quirks get discovered and patched regularly; what's unusual here is watching four major AI labs handle the same disclosed vulnerability four different ways within the same three-month window. Two vendors treated it as a straightforward supply-chain security fix and shipped patches quickly. One left users exposed with no stated timeline. One used the disclosure as a reason to sunset a product rather than fix it, which — while arguably a legitimate business decision — leaves an unknown number of installed copies permanently vulnerable since there is no mechanism to force an upgrade to Antigravity.

For teams building on any of these platforms, the practical takeaway is to check plugin sources: if your organization uses third-party plugins with Claude Code or Codex, confirm you're on the patched versions (2.1.179+ and 0.146.0+ respectively). If you use GitHub Copilot or Gemini CLI with non-GitHub-hosted plugins, treat those plugin sources as unpinned and untrusted until a fix ships — pinning to a commit hash currently provides no actual protection on those platforms.