Plugin4Shell Hit Claude Code, Copilot, and Gemini CLI — Is Your AI Coding Agent Still Exposed? (2026)
A plugin marketplace is supposed to be the safe way to extend a coding agent — you pin a plugin to a specific, audited commit, and the agent only ever runs that exact code. Plugin4Shell breaks that promise. It lets whoever controls the plugin’s repository swap in different code after the fact, and the affected agents never noticed the switch.
Security firm Air Security disclosed the flaw on September 17, 2026, and named it after the way it lets a repo owner slip malicious code past a lock that was supposed to be tamper-proof.
What This Covers
- What is Plugin4Shell, and why does it matter for your setup?
- Which AI coding agents are actually exposed right now
- How do you check if you’re running a patched version?
- What should you do if you’re still on Copilot or Gemini CLI?
- How the exploit actually works, in plain terms
- Is this being actively exploited, or just a theoretical risk?
- Before you move on
- FAQ
What Is Plugin4Shell, and Why Does It Matter for Your Setup?
Plugin4Shell is a zero-click remote code execution flaw in how four AI coding agents install and update plugins (air.security). The agents pin a plugin to a 40-character commit hash — the idea being that even if the plugin’s maintainer later gets compromised, your installed copy stays locked to the version someone already reviewed.
The problem is that git treats a branch name as higher priority than a commit hash when the two look identical. An attacker who controls the repository can create a branch with the exact same name as the pinned hash, point it at malicious code, and set it as the default branch — and none of the four agents confirmed the checkout actually landed on the real, audited commit.
When I checked the vendor patch notes for this, both Anthropic’s and OpenAI’s changelogs explicitly reference “commit verification” fixes dated within days of the September 17 disclosure — which lines up with how fast a flaw like this typically gets patched once it’s public.
Which AI Coding Agents Are Actually Exposed Right Now
As of September 23, 2026, two of the four affected agents have a confirmed fix and two do not (thehackernews.com). Here’s where each one stands.
| Agent | Status | Fixed In | What to Do |
|---|---|---|---|
| Claude Code | Patched | v2.1.179 | Update now, confirm version |
| OpenAI Codex | Patched | v0.146.0 | Update now, confirm version |
| GitHub Copilot | Unpatched | None yet | Restrict plugin sources, monitor for a fix |
| Gemini CLI | Deprecated, no fix | Not planned | Migrate to Google Antigravity |
No CVE identifier had been assigned to Plugin4Shell as of September 23, 2026, and neither Microsoft nor Google had published a formal security advisory for it (air.security). That doesn’t make the risk smaller — it just means the usual tracking number you’d search for doesn’t exist yet.
How Do You Check If You’re Running a Patched Version?
Run the version command for whichever agent you use, then compare it against the table above.
- Claude Code:
claude --version— you want 2.1.179 or later. - Codex:
codex --version— you want 0.146.0 or later.
If either shows an older number, update through your usual package manager (npm, pip, or the agent’s built-in updater) before you install or refresh any plugin. Updating after a plugin’s already been swapped doesn’t undo the swap — check your plugin list for anything you don’t recognize before you update, not just after.
What Should You Do If You’re Still on Copilot or Gemini CLI?
For Copilot, Microsoft hadn’t shipped a fix as of the most recent disclosure updates, so the practical move is to restrict which plugin repositories you allow and avoid installing anything new from a source you don’t personally control until a patch lands.
For Gemini CLI, Google’s answer isn’t a patch — it’s a retirement notice pointing users toward Antigravity instead. That’s a bigger lift than updating a version number, but running a deprecated tool with a known, unpatched RCE isn’t a great place to sit for weeks.
You’ll probably notice this is more disruptive for teams running CI pipelines through Copilot or Gemini CLI than for solo developers — pipeline plugin sources are exactly the kind of thing worth auditing this week, not next quarter.
Solo builders who only use one or two well-known plugins face a smaller blast radius, but “well-known” isn’t the same as “immune.” Plugin4Shell doesn’t care how popular a plugin is — it cares whether the repository owner’s account gets compromised or turns malicious, and that can happen to a project with thousands of users just as easily as a small one.
How the Exploit Actually Works, in Plain Terms
Think of the commit hash pin as a padlock with a specific serial number stamped on it. The agent checks “does this look like the padlock with serial number X” — but it’s comparing the label, not testing whether the lock still opens the same door.
A repo owner creates a branch, names it after that exact serial number, and swaps the door behind it. The agent sees a match on the label and installs whatever’s behind door number two, no confirmation dialog, no click required from you at all.
This trips a lot of people up because “pinned to a commit” sounds airtight. It’s only airtight if the tool verifies the actual commit object, not just a string that resembles one.
Is This Being Actively Exploited, or Just a Theoretical Risk?
As of the most recent reporting, researchers disclosed Plugin4Shell responsibly rather than after observing it in active attacks, and no confirmed real-world breach tied to it had been publicly reported by September 23, 2026 (heise.de). That’s the good news. The less good news is that responsible disclosure means the technique is now public, and the two unpatched agents remain an open target until Microsoft and Google respond.
When I compared how the four vendors handled the same disclosure, only two treated it with the urgency of a same-week patch — the other two left users to manage the exposure on their own for now.
That gap matters more than it looks. A patched agent closes the door; an unpatched one leaves it open for as long as you keep using it with plugins enabled. Every week without a Copilot or Gemini CLI fix is another week where the only real protection is the workaround, not a proper close.
Before You Move On
- ✅ Check your agent’s version number today, not “this weekend.”
- ✅ Review your installed plugin list for anything you didn’t add yourself.
- ✅ On Copilot or Gemini CLI, restrict plugin sources until a fix ships.
- ✅ Re-check monthly — Plugin4Shell has no CVE yet, so it won’t show up in automated dependency scanners.
FAQ
Does Plugin4Shell require me to click anything to be affected?
No. That’s the defining feature of this flaw — an already-installed, already-trusted plugin can be swapped for malicious code during a routine update, with no click, approval, or reinstall prompt involved.
Is Plugin4Shell the same as a supply-chain attack on npm or PyPI packages?
It’s related but distinct. Traditional package-registry supply-chain attacks compromise the package itself. Plugin4Shell exploits how the coding agent verifies which version of a plugin it’s running, even when the plugin’s own repository looks fine at a glance.
Should I stop using GitHub Copilot or Gemini CLI entirely until this is fixed?
Not necessarily — restricting plugin sources and avoiding new, unverified plugin installs reduces most of the practical risk while you wait. If you don’t use plugins with either tool at all, your exposure is much lower to begin with.
Sources
- Air Security — Plugin4Shell disclosure
- The Hacker News — Plugin4Shell coverage
- heise online — Critical flaw in four AI coding agents
Fact-checked based on public sources as of September 26, 2026. Patch versions and vendor advisories can change quickly on an active disclosure — check the sources above before you act.
