Plugin4Shell Lets a Plugin Owner Swap Approved Code in Four AI Coding Agents

AIR Security researchers Or Nevo, Dor Granat, and Niv Hoffman disclosed Plugin4Shell on September 17, a flaw in how four AI coding agents install plugins, per The Register. The agents check out a plugin's pinned commit without verifying the checkout landed on that commit. Whoever controls the plugin repository can serve different code while the pin still looks honored, and auto-updates deliver it with no click from the user.

Patch status splits. Anthropic fixed Claude Code in version 2.1.179, and OpenAI fixed Codex in 0.146.0. Microsoft had not issued a fix for GitHub Copilot at disclosure, and Google says Gemini CLI is deprecated, will not be patched, and its users should move to Antigravity, per Help Net Security. The exposure is also narrower than "zero-click" suggests. The trick depends on a branch named as a 40-character hex string. GitHub rejects those names. Bitbucket and self-hosted Git servers allow them, so the attacker needs a plugin hosted where that naming works.

The attacker also has to own a trusted plugin, either by publishing one that behaves until it is widely installed or by taking over a repository users already rely on. That places Plugin4Shell in the same class as the PyPI case from Anthropic's incident report: trust granted at install time, abused later through an update path nobody re-reviews.