A single git trick beat the safety lock on four AI coding agents

The AI industry already knew attackers could poison plugin marketplaces. Its answer was to lock every plugin to one reviewed version of its code. That lock is what just broke.

Researchers at Air Security published a vulnerability on Thursday that they call Plugin4Shell. It affects the four most widely used AI coding agents. Those are Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot and Google’s Gemini CLI. Or Nevo, Dor Granat and Niv Hoffman call it zero-click remote code execution. The attacker needs no action at all from the victim. Jessica Lyons first reported it for The Register.

Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Microsoft has shipped no fix for Copilot. Google will not fix the Gemini CLI, because it is retiring it.

What Plugin4Shell actually does

Coding agents install add-ons from marketplaces. To keep those add-ons safe, a marketplace pins each one to a commit hash. That is a 40-character string identifying one exact snapshot of the code. Review the snapshot once, pin it, and the agent should run that same audited code forever.

Air found that the agents ask for the pinned snapshot but never check what they got. Git lets a branch carry almost any name, including a string that looks exactly like a commit hash. When a name is both a valid branch and a valid object, git quietly prefers the branch.

So whoever controls a plugin’s repository can create a branch named after the pinned hash. They point it at different code and make it the default. The agent checks out the branch, installs the attacker’s code, and reports a clean install at the pinned commit.

The Gemini CLI breaks a different way. It fetches the right commit, then runs a checkout that a default branch named FETCH_HEAD can capture. The correct code never reaches the disk.

The fix is one line. After checking out, resolve what actually sits in the working tree, then abort unless it matches the pin.

Why nobody has to click

Agents refresh installed plugins in the background. Claude Code and Codex do this by default. So the attack does not need anyone to install anything new. It replaces a plugin the developer already trusts and already runs.

Air lays out the sequence. Publish something genuinely useful. Pass review, gather users. Ship a routine update so the marketplace re-pins to a new commit. Then create a branch named after that new pin and fill it with malicious code. Every agent’s auto-update does the rest.

A plugin runs with the same access as the person using the agent. The swapped code therefore reaches their files, their stored credentials and every system they can log in to. OWASP flagged that same problem this month, moving excessive agency to third place in its 2026 top ten.

GitHub says its users are not exposed

GitHub rejects branch names shaped like commit hashes, so the branch trick fails there. A spokesperson told The Register that this mitigation stops anyone exploiting the vulnerability on GitHub.

Air disagrees. Marketplaces can sit elsewhere, including on Bitbucket and on a company’s own git server. Both of those allow hash-shaped branch names, and Anthropic’s own documentation lists them as valid marketplace backends. Copilot supports those hosts too, which is where Air says the risk sits. Microsoft did not respond to The Register.

This is not the first time GitHub has contested a researcher’s finding about Copilot. It is worth noting that roughly 90% of Fortune 500 companies use Copilot, on Microsoft’s own figure, and Copilot is one of the two agents with no patch.

How much of this reaches real developers

Plugin4Shell is narrower in practice than the headline count of four agents suggests, and the most useful reporting on that came from The Hacker News. Swati Khandelwal checked the marketplaces the agents ship with on 18 September and found that every plugin in Anthropic’s community catalogue, and in the default catalogues for Claude Code and Copilot, points to a GitHub repository.

The two halves of the attack also pull apart. Background auto-update is the part that makes it zero-click. It runs by default only for the agents’ own built-in marketplaces, and those live on GitHub. For outside marketplaces it stays off or optional. A developer who installs only from the default catalogues never meets the branch-name version.

That reasoning does not cover the Gemini CLI. Its variant relies on a branch named FETCH_HEAD rather than a hash, and GitHub’s rule does not clearly block that name. It is also the one agent nobody will ever patch.

Four months, no CVE

Air built a working proof of concept in May and disclosed to all four vendors in June. Anthropic confirmed its fix on 17 June. Google said on 4 August that none would ship. Codex was verified fixed on 12 August.

As of 18 September, The Hacker News found no CVE identifier assigned and no security advisory published by any of the four vendors. Anthropic’s release notes for 2.1.179 do not mention the fix at all, so Air’s post is the only public account that it exists. There is no sign the flaw has been used in a real attack.

Four months of silence is a long time for a flaw in software the Fortune 500 runs. It also sits awkwardly beside where European rules are heading. The Cyber Resilience Act sets a 24-hour reporting deadline for actively exploited vulnerabilities and pushes hard towards documented software supply chains.

The third time this has happened

Air has been working this seam for months. It planted a malicious skill in a marketplace and reached about 26,000 agents. It then hijacked 925 skills already in use, affecting 134,000 agents, by taking over the repositories behind them.

SHA pinning was the industry’s answer to both. Five labs agreed a common plugin standard in August. Attackers now go after the distribution layer underneath the models rather than the models themselves. The same design error appeared in four products from four different companies, which suggests nobody checked the assumption rather than that one team slipped.

One thing the published accounts do not settle: whether updating an affected agent removes a plugin that was already swapped, or only stops the next swap. Developers who have seen Claude Code hijacked before, or watched OpenAI agents turn up inside RubyGems, will recognise the pattern.

The Gemini CLI stays vulnerable permanently. Google points users at Antigravity instead, which the attack cannot reach because it has no plugin pinning to bypass. The question worth revisiting in a year: how many Gemini CLI installs are still running.