Flaw in four AI coding assistants let vetted plugins be swapped for malicious code

Security researchers have disclosed a flaw that let attackers silently replace previously reviewed plugin code with malicious code inside four of the most widely used AI coding agents, defeating the commit-pinning safeguard that developers rely on to know exactly what software they installed. The vulnerability, named Plugin4Shell by the researchers at AIR Security's research lab, which published the technical writeup, affects Anthropic's Claude Code, OpenAI's Codex, Microsoft's GitHub Copilot and Google's Gemini CLI.

The bug does not require a victim to click anything. Because plugin auto-updates run in the background by default in Claude Code and Codex, an attacker who controls the source repository behind a plugin can push the swap at any time after installation and have it reach every user who already trusted and installed that plugin, with no warning that anything changed.

How the pinning check gets bypassed

Plugin marketplaces built into coding agents typically lock an installed plugin to a specific version by recording the 40-character SHA-1 hash of the git commit that was reviewed. When the agent later installs or updates the plugin, it is supposed to fetch and check out that exact commit, guaranteeing the code that runs matches the code that was audited.

AIR Security's researchers found that the affected agents perform the checkout but never verify afterward that the working tree actually landed on the pinned hash. For Claude Code, Codex and GitHub Copilot, an attacker who controls the plugin's repository can create a branch whose name is identical to the pinned commit SHA and make it the repository's default branch; because git resolves a matching reference name ahead of a raw commit object, the checkout silently pulls the attacker's branch instead. Gemini CLI has a related but distinct flaw: naming a branch "FETCH_HEAD" causes the client to resolve to that branch rather than the fetched commit. In both cases, the agent reports a successful, verified installation while running code the plugin's original reviewers never saw.

"It is the first supply chain vulnerability of the AI agent ecosystem," AIR Security's researchers wrote, warning that developers who "install plugins from a marketplace they trust, that were reviewed and pinned exactly as the security model intends" remain exposed.

Timeline and the numbers

According to AIR Security and confirmed independently by The Register's reporting on the disclosure, researchers found the bug in May 2026, built working proof-of-concept exploits against all four agents, and privately reported it to Anthropic, OpenAI, Microsoft and Google in June 2026 under a standard 90-day responsible disclosure window before going public this week. No exploitation in the wild, data theft or confirmed compromise tied to Plugin4Shell has been reported by any of the four companies or by the researchers.

Patch status is uneven four months after disclosure:

• Anthropic fixed Claude Code in version 2.1.179, a release published to the project's official GitHub release page, which AIR says it confirmed as remediated on June 17.
• OpenAI fixed Codex in version 0.146.0, listed on the Codex repository's release history.
• Microsoft has not shipped a fix for GitHub Copilot. The company says a platform-level mitigation already covers the issue; researchers dispute that, arguing marketplaces hosted outside GitHub itself, such as on Bitbucket, remain in scope and are still exploitable. GitHub's own security-advisory page for the Copilot CLI project does not currently list an advisory addressing the flaw.
• Google has not patched Gemini CLI at all. The company deprecated the tool in August and is directing users to migrate to its newer Antigravity CLI instead of fixing the underlying agent.

Who is exposed

The four affected products are among the most heavily used AI coding assistants in professional software development, embedded in developer workflows at companies that range from individual contractors to large enterprises. Plugin marketplaces for these agents let developers add tools such as linters, deployment scripts and testing frameworks directly into an agent's workflow, and pinning a plugin to a reviewed commit is the mechanism many security teams rely on to treat that code as vetted, similar to how software supply-chain tools pin dependencies in traditional package managers.

Because the flaw sits in how each agent's client resolves a pin locally, rather than in how a marketplace stores or serves plugins, no marketplace-side fix can close the hole on its own; each affected vendor has to change how its own agent performs the checkout. That leaves organizations using unpatched GitHub Copilot or Gemini CLI installations with no vendor-side remedy beyond removing or restricting plugin auto-updates, or migrating away from the affected tool entirely.

Reaction

Coverage since the disclosure has emphasized the novelty of a supply-chain attack aimed specifically at the trust mechanisms of autonomous coding agents rather than at conventional software dependencies. Help Net Security's writeup of the research noted that the same class of risk has shown up before in related work from the same lab: an earlier test plugin the researchers seeded reached more than 26,000 installed agents, and separate "skill-hijacking" research the group published identified 925 compromised skills affecting roughly 134,000 agents, underscoring how quickly a single tainted package can spread through these marketplaces once it is trusted and pinned.

SecurityWeek's summary of the disclosure and additional reporting from The Hacker News both described the flaw as demonstrating that code-review and commit-pinning practices developers imported from traditional software engineering do not automatically transfer to agentic tools, because the verification step many assume happens after a pinned checkout simply was not being performed by the agents themselves.

What happens next

With two of the four vendors still unpatched, security teams that rely on GitHub Copilot or Gemini CLI plugin marketplaces face a choice between disabling automatic plugin updates, auditing which plugins their organizations have installed and from which repositories, or waiting on further vendor action. Microsoft's dispute with researchers over the scope of its stated mitigation leaves open the possibility that additional guidance or a more complete fix follows in the coming weeks. Google's decision to deprecate rather than patch Gemini CLI means organizations still running it have no long-term vendor support path other than migration. AIR Security has said it will continue to test other coding-agent marketplaces for the same class of pin-verification gap, suggesting Plugin4Shell may not be the last disclosure of its kind in what researchers are now describing as an emerging category of AI agent supply-chain risk.