AI Pulse

Plugin4Shell Broke the Same Assumption Across Four AI Coding Agents. Two Are Still Unpatched.

By Felix Maru · September 21, 2026 · 6 min read

On September 17, 2026, a security research team called AIR publicly disclosed a vulnerability they had found four months earlier. They named it Plugin4Shell. It affects Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI simultaneously. Anthropic and OpenAI shipped patches. Microsoft has not. Google deprecated Gemini CLI instead of fixing it. That is where things stand this morning.

This is the kind of story that gets overshadowed by model benchmarks and funding rounds. It should not be. Plugin4Shell is the first confirmed supply-chain vulnerability in the AI agent ecosystem, and the mechanism it exploits is not exotic: it is an assumption so reasonable that four separate engineering teams made it independently.

The Trust Model SHA Pinning Was Built On

When an AI coding agent installs a plugin, it faces a basic security problem: how do you know the plugin you're installing today is the same one you reviewed last month? The ecosystem's answer was SHA pinning. You lock the plugin to a specific commit hash, a long string that uniquely identifies a snapshot of the code. Every time the agent installs or updates the plugin, it checks out that exact hash. The idea is sound: commits in git are content-addressed, so the same hash always points to the same code.

The flaw is in the verification step, or rather the missing one. According to Startup Fortune's coverage of the AIR disclosure, the affected agents checked out the hash by name but did not subsequently verify that the code in the working tree actually matched it. That difference matters because git's checkout logic resolves by name first, and on most hosting platforms, branch names can be formatted to look identical to commit hashes.

How Plugin4Shell Actually Works

The attack is conceptually simple once you see it. An attacker who controls a repository creates a branch whose name is the same string as the plugin's pinned commit hash. Git resolves the checkout to that branch rather than the original commit. The agent proceeds without noticing the difference. Because AI coding agents often run background plugin updates automatically, no user action is required. That is the zero-click part.

The blast radius is whatever permissions the coding agent inherited from the developer running it, typically read-write access to local source code, stored cloud credentials, SSH keys, and any internal repository or production system the developer's machine can reach. Forkast News described it as the first supply-chain attack vector purpose-built for the AI agent layer, not the dependencies underneath it.

Vulnerable (before patch)
  • Agent checks out pinned hash by name
  • No post-checkout verification
  • Attacker's branch (same name as hash) silently runs
  • Malicious code inherits dev's full credentials
Patched (Claude Code 2.1.179, Codex 0.146.0)
  • Agent checks out pinned hash by name
  • Resolves actual commit in working tree
  • Mismatch detected: install aborted
  • Legitimate code runs, nothing else
The fix is one verification step added after checkout. Anthropic and OpenAI shipped it. Microsoft and Google have not.

AIR found the vulnerability in May 2026, built working proof-of-concept exploits against all four agents, and disclosed it to each vendor the following month, per Help Net Security's September 18 report. No exploitation in the wild has been claimed. The 90-day responsible disclosure window expired, which is why it went public last week.

Who Patched, Who Did Not, and What to Check Right Now

The patch status as of this morning, sourced from The Hacker News and the AIR disclosure summary:

If you are running Copilot or Gemini CLI with plugins from external repositories, you are currently relying on the fact that nobody has targeted those plugins yet. That is not a security posture. At minimum, audit which plugins you have installed, check whether the repositories hosting them allow branch names formatted as commit hashes (most major hosts permit this by default), and consider disabling auto-update until a patch ships.

The industry's answer to plugin trust was SHA pinning. Plugin4Shell shows that pinning is only as strong as the verification logic that follows it. (Paraphrase, Forkast News)

Why This Story Is Bigger Than the Patch Numbers

This week, Bloomberg and the New York Times reported that Anthropic is pacing toward over $100 billion in annualized revenue this year, up from roughly $65 billion disclosed in July. The company pushed its IPO from October to November to include Q3 numbers, and investors are reportedly pricing it at around $2 trillion. Claude Code and Cowork enterprise adoption are cited as primary growth drivers.

That context matters for Plugin4Shell in a specific way. When Claude Code was a developer curiosity, a supply-chain vulnerability in its plugin ecosystem was a niche risk. At the scale Anthropic is describing, Claude Code is running on machines inside many of the largest engineering organizations on earth. The blast radius of a successful attack through that channel is not a few affected developers. It is potentially a significant share of the enterprise software development pipeline.

The same is true across all four affected tools. AI coding agents are no longer experimental. They are infrastructure. And infrastructure that auto-updates plugins from external repositories without verifying what actually landed is infrastructure with a known open door for two of those four agents right now.

The lesson I keep relearning in IT: the security model of a category is designed when that category is small and the stakes are low. It gets tested when the stakes are high. The SHA pinning assumption made sense in a world where a handful of developers used AI plugins experimentally. It did not survive contact with a world where those agents run continuously on developer machines inside companies managing production systems, customer data, and financial infrastructure.

What You Should Do Before the Week Is Out

Three concrete actions, regardless of which tool you use:

  1. Check your version. Claude Code 2.1.179 and Codex 0.146.0 are patched. If you are below those, update now. For Copilot and Gemini CLI, there is no patch to install, which is a harder problem.
  2. Audit your installed plugins. List every plugin your AI coding agent has installed, trace each one to its source repository, and check whether that repository is one you control or trust with production access. Anything from an unknown third party deserves scrutiny.
  3. Review your auto-update settings. If your agent silently updates plugins in the background, decide whether that trust model still makes sense. A manual update step is slower. It is also an audit point.

Plugin4Shell is patched for two of the four agents. The fix is, by all accounts, technically straightforward. The more interesting question is why it took a public disclosure to get it shipped, and whether the remaining two vendors will move faster now that the vulnerability is public.

Sources

If you are an IT or ops practitioner working out how to govern AI tools in your environment, reach out. Happy to compare notes on what is actually working.

Share 𝕏 in ✉

Comments