Plugin4Shell: Plugin SHA-Pin Bypass in Claude Code, Codex, Copilot, Gemini CLI

A bug that sounds trivial turned out to be shared by four of the most widely used AI coding agents. On 17 September 2026, Air Security published Plugin4Shell, which it describes as a zero-click remote code execution flaw in the plugin systems of Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. Each agent pinned plugins to a 40-character commit SHA, checked it out, and never verified that the checkout actually landed on that commit. Anthropic fixed Claude Code in 2.1.179 and OpenAI fixed Codex in 0.146.0. Google told the researchers it will not patch Gemini CLI at all.

What happened

Plugin marketplaces for coding agents work a lot like GitHub Actions: a catalogue entry points to a repository and a pinned commit, and the agent fetches and installs it. Pinning to a full SHA is the standard advice for exactly this reason, and it is what made Plugin4Shell interesting.

The Register's report, by Jessica Lyons, names the researchers as Or Nevo, Dor Granat and Niv Hoffman, who call it a "plugin SHA-pinning bypass". The trick, per Air's write-up:

• Claude Code, Codex and Copilot: the attacker creates a branch whose name is the pinned 40-hex SHA and makes it the default branch. When the agent runs a checkout by that string, Git resolves the branch name instead of the commit.
• Gemini CLI: the attacker names the default branch FETCH_HEAD, so git checkout FETCH_HEAD lands on the branch rather than the commit that was just fetched.

The "zero-click" label is Air's, and it comes from auto-update. Air says Claude Code and Codex update installed plugins in the background by default. A plugin that passed review, or a legitimate plugin whose repository is later hijacked, can swap in new code that runs with the developer's full permissions without anyone typing a command.

The fix status

Air's timeline says it found the issue in May 2026 with a working proof of concept against all four agents, and reported it to the vendors in June. Anthropic confirmed its fix in June, Google said on 4 August that no fix would ship and pointed users to Antigravity, and Codex 0.146.0 was verified fixed on 12 August. Anthropic published CVE-2026-86063 in a GitHub security advisory on 9 October. The Cloud Security Alliance research note said no CVE had been assigned at disclosure, which matches.

The Copilot row is where accounts differ. At disclosure, The Register said Microsoft had not fixed Copilot and that Air got no response to its June report. Air's page, which has been updated since, now says Microsoft fixed the flaw for Copilot in VS Code 1.136.0, released on 2 September, before the public disclosure. I have not seen a Microsoft advisory that names Plugin4Shell, so check your own VS Code and Copilot versions rather than trusting either summary.

GitHub's position

GitHub told The Register the attacks do not affect GitHub-hosted repositories because it blocks branch and tag names that look like commit SHAs: "This mitigation ensures the reported vulnerability cannot be exploited on GitHub." That is true for the branch variant on github.com. It does nothing for the FETCH_HEAD variant, and as Air points out, agents also support marketplaces on other Git hosts, such as Bitbucket, where the restriction does not apply.

Why it matters

Plugin4Shell is part of a busy autumn for coding-agent bugs. In the same month, researchers reported malicious Git configuration tricks that could make agents such as Claude Code run code. The common thread is that coding agents inherited the trust model of developer tools (Git, package managers, editor extensions) and then added automation on top. Automation removes the human pause that used to catch odd behaviour.

It is also a reminder that "pin to a SHA" is advice about intent, not enforcement. The pin is only as good as the code that checks it. GitHub Actions users learned a version of this the hard way, which I covered in the Actions supply chain post.

What sceptics say

Neither Air nor the CSA note reports Plugin4Shell being exploited in the wild. Anthropic's advisory also frames the bar differently from Air: it says exploitation "required a user to install a malicious plugin", pin it to a safe hash, and use a Git host that allows SHA-shaped branch names. Exploitation requires control of a plugin repository or getting a plugin accepted into a marketplace first, which is a meaningful hurdle. GitHub's naming restriction blocks the most common variant for repositories hosted there, and Anthropic and OpenAI had shipped fixes weeks to months before public disclosure. Gemini CLI is deprecated, so its user base is shrinking. A fair summary is "real design flaw, narrow exploitation window, mostly closed". The part that is not closed is the Gemini CLI installs nobody has migrated.

What it means for engineering and DevOps teams

My take (opinion): treat coding-agent plugins exactly like CI dependencies, because that is what they are. A quick check on a developer machine looks like this:

# Versions that include the Plugin4Shell fixes (per Air Security, Sept to Nov 2026)
claude --version    # want 2.1.179 or later
codex --version     # want 0.146.0 or later
code --version      # VS Code 1.136.0 or later for the Copilot fix
which gemini && echo "Gemini CLI present: deprecated, no fix, plan migration"

Beyond that:

• Turn off plugin auto-update wherever you cannot confirm a patched version, and review plugin updates like dependency bumps.
• Allowlist plugin sources. Fewer marketplaces means fewer repositories an attacker can take over.
• Run agents with least privilege. A plugin inherits the agent's permissions; if the agent can reach production credentials, so can a malicious plugin. Sandboxing agents, as covered in the isolation comparison, limits the blast radius.
• Retire Gemini CLI. If it is still installed on build hosts or laptops, remove it.

For hardening the agent itself, this guide to running coding agents in GitHub Actions safely covers token scoping and approval gates.

FAQ

What is Plugin4Shell?

Plugin4Shell is what Air Security, which disclosed it on 17 September 2026, calls a zero-click remote code execution flaw. It let a malicious plugin repository bypass SHA pinning in Claude Code, Codex, GitHub Copilot and Gemini CLI by naming a branch after the pinned commit (or FETCH_HEAD), so the agent installed attacker code.

Is Claude Code still vulnerable to Plugin4Shell?

Not if you run Claude Code 2.1.179 or later, which Anthropic confirmed fixes the issue; it is tracked as CVE-2026-86063. Older versions were exposed if you had installed a plugin whose repository an attacker controlled, on a Git host that allows SHA-shaped branch names (github.com does not). Anthropic says users on standard auto-update have already received the fix.

Will Google patch Gemini CLI?

No. Google told the researchers that Gemini CLI is deprecated and will not receive a fix, and recommends moving to Antigravity.

Related: GitHub Actions Security in 2026: 76 Hijacked Tags and the Fixes That Work, Container vs microVM vs gVisor: Choosing Agent Isolation and How to Run an AI Coding Agent in GitHub Actions Safely (2026).