Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents
Air Security disclosed Plugin4Shell, letting repository owners swap version-locked plugins in Claude Code, Codex, GitHub Copilot, and Gemini CLI.
Air Security found that four widely used AI coding agents fetch version-locked plugin snapshots without verifying the code matches the pinned commit hash, letting repository owners serve different code via a hash-shaped branch name on hosts like Bitbucket or self-hosted git servers. Anthropic fixed the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; GitHub Copilot has no fix, and Google will not patch the retired consumer Gemini CLI, pointing users to Antigravity. A Gemini CLI variant abuses a main branch named FETCH_HEAD, which GitHub's naming rules do not clearly block. Air reported a working test attack in June 2026; no CVE has been assigned, no vendor advisories exist, and no real-world exploitation has been observed.
- Agents fetch pinned commit snapshots but never verify retrieved code matches the locked hash
- Hash-shaped branch names on Bitbucket or self-hosted git enable the swap; GitHub blocks such names
- Gemini CLI variant abuses a main branch named FETCH_HEAD; Google won't patch, points to Antigravity
- Swapped plugins run with user privileges, exposing files, credentials, and accessible systems
- Air reported in June 2026; no CVE assigned, no vendor advisories, no observed exploitation
- Organizations
- Microsoft
From the original article
4 min read at thehackernews.com
A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has patched the flaw in Claude Code 2. 1.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.