Security researchers at Air Security disclosed a software supply-chain vulnerability, nicknamed Plugin4Shell, that lets any repository owner silently substitute the code a plugin executes inside Claude Code, OpenAI Codex, GitHub Copilot, and Google’s Gemini CLI, even when that plugin is supposedly locked to a specific, previously reviewed commit hash. For enterprises that spent 2026 wiring AI coding agents directly into CI/CD pipelines, the flaw undercuts the one control, SHA-pinning, that security teams have relied on to trust third-party agent plugins in the first place.

How Plugin4Shell Works: A Git Trick, Not a Model Flaw

The bug has nothing to do with any of the four companies’ underlying AI models. Affected agents fetch plugin snapshots identified by a commit hash but never verify that the checked-out working tree actually matches that hash. An attacker creates a branch whose name resembles the 40-character commit SHA (or, in Gemini CLI’s case, a branch literally named FETCH_HEAD) and points it at malicious code. When the agent resolves what it believes is a pinned, immutable reference, Git can instead interpret the requested SHA as a branch name, silently checking out a different commit than the one that was reviewed and approved. No CVE has been assigned to the flaw.

Why It’s Zero-Click for Two of the Four Agents

Because Claude Code and Codex auto-update installed plugins by default, an attacker doesn’t need to trick anyone into installing anything new. They publish a legitimate, well-reviewed plugin, wait for organic adoption, then quietly repoint the upstream branch later. The next automatic update silently pulls the malicious version with no user action required, the definition of zero-click in a supply-chain context. Air Security notified all four vendors in June and disclosed publicly on September 18, after a roughly three-month coordinated window, and reports no confirmed real-world exploitation to date.

Four Vendors, Four Different Responses

The disclosure has become as much a story about vendor response speed as about the bug itself. Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in version 0.146.0. Microsoft has issued no fix for GitHub Copilot as of publication. Google isn’t fixing Gemini CLI at all: the product is being deprecated in favor of Antigravity, the company’s newer agent, and affected users are simply being told to migrate. GitHub’s hosted infrastructure separately blocks branch and tag names that resemble commit hashes, which protects plugin repositories hosted there regardless of which agent pulls from them, but that protection doesn’t extend to Bitbucket or self-hosted Git servers, where all four agents remain exposed today.

The Blast Radius: What an Attacker Actually Gets

A successful swap runs with the developer’s own account permissions, meaning proprietary source code, saved credentials, API keys, CI/CD secrets, and whatever cloud environments that developer’s machine can reach are all in scope. That access level matters more for AI coding agents than for a compromised browser extension or IDE plugin, because these agents are increasingly granted broad, semi-autonomous permissions specifically so they can commit code and trigger pipelines without a human reviewing every step, precisely the workflow Plugin4Shell abuses to operate without detection.

How Enterprise Security Teams Should Respond

Because GitHub Copilot has no patch and Gemini CLI never will, defense for those two tools falls entirely on the customer side. Security teams should update Claude Code and Codex immediately to the patched versions, then audit their full plugin inventory across all four agents to identify which ones pull from Bitbucket or self-hosted Git infrastructure rather than GitHub, since those are the repositories where the branch-name protection doesn’t apply. Beyond inventory, the recommended defense is procedural: restrict plugin sources to a vetted allowlist, monitor watched repositories for unexpected branch or reference changes, and, for any agent still running exposed, manually verify that the resolved HEAD of a checked-out plugin actually matches its marketplace-pinned SHA rather than trusting the agent’s own version report, since Plugin4Shell’s entire mechanism is designed to make that self-report false.

What This Says About the AI Coding Agent Market’s Shared Assumptions

Plugin4Shell is less a story about any single vendor’s code quality than about an assumption all four companies built their plugin architecture on at roughly the same time: that a pinned commit hash is an immutable, verifiable reference. It wasn’t, for any of them. That convergence is what makes the competitive fallout interesting. Anthropic and OpenAI treated the disclosure as a same-quarter engineering fire drill and shipped fixes within the coordinated-disclosure window. Microsoft has left enterprise Copilot customers running exposed plugins with no patch timeline at all. And Google effectively answered the question by retiring the product outright rather than fixing it. As enterprises increasingly standardize coding-agent procurement around vendor security responsiveness, not just code quality, this kind of shared-vulnerability disclosure is becoming a real proxy for trust, and on that proxy, Microsoft is the vendor with the most explaining left to do.