**Plugin4Shell: the zero-click RCE that traversed Claude Code, Codex, Copilot, and Gemini CLI — and the two vendors that never patched it**

Plugin4Shell: the zero-click RCE that swept through Claude Code, Codex, Copilot and Gemini CLI — and the two vendors that never patched

🔎 Four agents, one flaw, two silences

On September 17, 2026, the AIR security lab published the Plugin4Shell disclosure: a zero-click RCE that simultaneously affects Claude Code, Codex, GitHub Copilot and Gemini CLI, the four most widely deployed code agents in the world. The Register relayed the news the very same day, with Help Net Security and the trade press following on September 18 and 19.

The mechanism is chillingly elegant: a simple git branch named like a commit hash is enough to hijack a plugin installation, while the agent reports a "clean" install. No click, no prompt, no alert. Plugin auto-update does the attacker's work for them.

And the patching record is uneven — that's the real scandal of this story. Anthropic fixed Claude Code in 2.1.179 back on June 17, 2026. OpenAI fixed Codex in 0.146.0. Google deprecated Gemini CLI without ever patching it. Microsoft, notified in June, had shipped no fix for Copilot at the time of disclosure.

This flaw says nothing about the quality of the models. It says everything about the maturity of the agent distribution chain — and that's the subject of this article: how it works, who patched, who dragged their feet, and what to do this morning.

The essentials

• Plugin4Shell: a zero-click RCE disclosed by AIR Security on September 17, 2026, affecting plugins for Claude Code, Codex, GitHub Copilot, and Gemini CLI.
• The mechanism: git resolves a branch named exactly like the pinned SHA in preference to the commit itself. The checkout lands elsewhere while the agent reports a "clean" install.
• Zero-click: Claude Code and Codex auto-update plugins in the background by default. The plugin runs with the agent's permissions — source code, cloud credentials, SSH keys, sometimes production.
• Patches: Claude Code 2.1.179 (fix confirmed on June 17, 2026) and Codex 0.146.0 (verified on August 12, 2026). Gemini CLI: deprecated, never patched. Copilot: no fix as of September 19, 2026.
• Context: AIR had already documented 925 hijacked skills affecting ~134,000 agents (SkillJacking). Plugin4Shell is the second major agent vulnerability of September, after GitSpawn.
• The fix comes down to a single line in the agent: verify the commit actually present in the working tree after checkout. No marketplace can do it on the agent's behalf.

Recommended tools: status as of September 19, 2026

Sources: Pondero (09/19/2026), AI Weekly (09/19/2026), The Hacker News (09/18/2026), Help Net Security (09/18/2026).

A status table, not a ranking: the only metric that matters this month is "do I have the patch?". If you need to (re)choose a coding agent, cross-reference this table with our comparison of the best AI tools for coding.

The mechanism: git prefers a branch over a hash

Direct answer: Plugin4Shell hijacks the git checkout by making a commit SHA resolve as a branch name. The agent checks the pin, but never the result of the checkout.

Let's start with what should work. When you install a plugin in Claude Code, Codex, Copilot or Gemini CLI, the installation is pinned to a specific commit: a 40-character hexadecimal SHA. The agent verifies that this SHA matches what is declared. So far, the chain of trust holds.

Where it breaks: the agent never verifies that the checkout actually landed on that commit. This is the key point of the AIR Security disclosure — a "first-of-its-kind AI supply-chain attack" that targets neither the model, nor the agent itself, but the distribution layer: the plugin marketplaces.

The attack boils down to a single manipulation. The attacker controls the plugin repo. They create a branch whose name is exactly the pinned SHA — 40 hexadecimal characters, a perfectly valid branch name. At checkout time, git resolves the reference: a ref is always preferred over an object id. So the checkout goes to the attacker's branch, not to the pinned commit. The only red flag is a warning nobody reads: "refname is ambiguous".

The result: malicious code runs while the pin appears to be honored. The agent reports a clean install. The Hacker News cites OpenAI's own description: "Git can interpret a requested commit SHA as a branch name".

Two conditions limit exploitation: the host must allow a branch named like a hash, and that branch must be the repo's default branch. Restrictive on paper — except that the attacker who controls the repo also controls its default branch.

The Gemini CLI variant: FETCH_HEAD

Gemini CLI doesn't take exactly the same path. Its clone/fetch/checkout FETCH_HEAD sequence opens a distinct variant: the repo's default branch can be named FETCH_HEAD and win the checkout all the same (The Hacker News, Help Net Security). Same design flaw, two entry points.

The fix fits in one line

And this is where the story becomes almost absurd. The fix recommended by AIR comes down to a single assertion:

test "$(git rev-parse HEAD)" = "<pinned-sha>" || abort

Resolve the commit actually present in the working tree after the checkout, and abort if it differs from the pinned SHA. This is the exact shape of the fix shipped by Anthropic and OpenAI, confirmed by Pondero. The lesson comes down to one sentence: the pin verifies an intention, the working tree is a reality. Four teams confused the two.

One last point, for those who would look toward the models: Plugin4Shell touches neither the model nor the prompt. Whether your agent runs on Claude Opus 4.7, GPT-5.5 or a self-hosted model like Kimi K2.6 changes absolutely nothing — it's the distribution layer that's under attack. Our comparison of the best LLMs for coding remains relevant for choosing a model, but it won't, on the other hand, protect you from any hijacked checkout.

Why "zero-click" changes everything

Short answer: because the victim does nothing. Claude Code and Codex auto-update installed plugins in the background by default — the payload executes without a click, without a prompt, without consent.

It's this detail that turns a git bug into a potential campaign. On Claude Code and Codex, automatic updating of installed plugins is enabled by default. The simplest attack scenario — a benign plugin swapped out after the fact — therefore requires no action from the victim: the agent fetches the hijacked code itself.

And a plugin has free rein. It runs with the agent's permissions: access to source code, cloud credentials, SSH keys, internal repos, sometimes production (StartupFortune, 09/18/2026). The Register sums up the stakes: attackers get "the keys to the kingdom" — everything the agent can reach.

Help Net Security goes further: the compromised agent has the same access as an employee to the company's systems. InfoWorld adds cloud and CI/CD systems to the list. The attack surface isn't your dev machine: it's the agent's operational identity, with everything it touches.

One developer installing a malicious plugin is an incident. Thousands of agents auto-updating a hijacked plugin is a campaign. This difference in scale is the real story.

Two attack scenarios, an ecosystem already riddled with holes

Direct answer: two entry points, both already demonstrated by AIR in its previous work — the benign plugin replaced, and the repo of a legitimate author hijacked.

Scenario 1: the benign plugin replaced

An author submits a legitimate plugin to a marketplace. They accumulate trust, installs, pins. Then they replace the code in the repo. Agents that auto-update follow along — pin included, checkout verification absent.

Scenario 2: the repo of a legitimate author hijacked

The attacker takes control of a trusted author's repo and pushes the branch under the pinned SHA's name. AIR had already demonstrated this pattern with SkillJacking and RepoJacking, The Register recalls, citing researchers Or Nevo, Dor Granat and Niv Hoffman.

The quantified precedents set the scale

AIR doesn't come out of nowhere. In SkillJacking, the lab had documented 925 skills already in active use that had been hijacked, reaching 134,000 agents (AI Weekly, September 19, 2026). In "The Story of Skills," a single malicious skill was enough to control more than 26,000 agents. And the case of the re-registered account hexiaochun, behind seedance2-api and its 11,483 installs, shows that a plugin's displayed provenance is worth nothing.

September 2026, the last straw

Plugin4Shell is only the second big agent security story of the month (Pulse of Nations). In early September, Manifold Security published GitSpawn: the repo's own git config names a command executed by the agent at session startup, with a payload triggered even before the workspace-trust prompt on several agents.

Before that: AgentJacking, where a fake bug report was enough to hack Claude Code, Cursor and Codex — 2,388 organizations affected, an 85% success rate (our analysis here). And OpenAI's agents had attacked RubyGems before the Hugging Face hack — a supply chain precedent we cover there.

Meanwhile, GreyNoise revealed the first global campaign of agent-generated exploits (our article). The loop is closed: agents are both the target and the weapon.

The patch scorecard: two fixes, one abdication, one silence

Direct answer: as of September 19, 2026, Anthropic and OpenAI have patched. Google deprecated Gemini CLI without fixing it. Microsoft has shipped no fix for Copilot.

First, a timeline recap: AIR reported the flaw to the four vendors in June 2026, as part of a 90-day responsible disclosure (byteiota). Public disclosure landed on September 17, at the end of the window. Each vendor therefore had three months.

Anthropic: patched in Claude Code 2.1.179

Anthropic's fix was confirmed on June 17, 2026 (Pondero) — within a month of the report to vendors. And consistent with AIR's finding, the fix lives in the agent, not in the marketplace: no marketplace can close the flaw on the agent's behalf (The Hacker News).

OpenAI: patched in Codex 0.146.0

OpenAI publicly described the bug — "Git can interpret a requested commit SHA as a branch name" — and shipped the fix "Verify Git plugin SHA checkouts" in Codex 0.146.0, verified as fixed on August 12, 2026 (The Hacker News, Pondero).

Google: deprecated, never patched

On August 4, 2026, Google confirmed that no fix will ship for Gemini CLI (AIR Security). The official answer: migrate to Antigravity, which does not implement the same SHA-pinning model (Pondero). AIR disputes the idea that Antigravity "eliminates" the risk: marketplaces can live on multiple hosting platforms (In Plain English).

An important nuance from andrew.ooo (September 19, 2026): the Gemini CLI npm package is NOT marked deprecated and still published version 0.60.0 on September 15, 2026, with nightlies up to September 18. The "retired" status concerns the consumer entitlement — the June 18, 2026 cutover to Antigravity — not the publication of vulnerable builds. The consequence: every existing installation remains exposed indefinitely (Help Net Security).

Microsoft: the silence

Microsoft received the disclosure in June 2026 and had shipped nothing as of publication, according to the researchers (In Plain English, Pondero). No official mitigation, short of removing the plugins. Copilot remains exposed, including through marketplaces hosted outside GitHub, such as Bitbucket.

The stakes here are scale. Microsoft puts Copilot usage at roughly 90% of the Fortune 500 (figure reported by The Register); GitHub claims roughly 90% of the Fortune 100 (reported by StartupFortune). The two figures differ in scope — so we attribute each to its own source — but the takeaway converges: the unpatched agent is also the most widely deployed in large enterprises.

GitHub closed a door, not the hallway

GitHub responds that it now prevents the creation of branches and tags resembling commit SHAs: exploitation is blocked on GitHub's side (The Register). AIR counters that this is not enough: plugin marketplaces can be hosted elsewhere, Bitbucket chief among them. A pin on a Bitbucket repo remains exploitable as is.

The real lesson: the trust chain of agent ecosystems

Direct answer: SHA-pinning was never an integrity guarantee — only a declared intention. And four independent teams built the same flaw without seeing it.

This is the detail that should worry us more than the flaw itself. The same design flaw was built by four independent teams, and none of them caught it before an external lab did (StartupFortune). This isn't an isolated blunder: it's a structural blind spot of the category.

The pattern is the same everywhere in 2026: trust rests on the name, the provenance, or a declared version — three signals that nothing actually verifies, as summarized in the French analysis from Pandia.pro. The pin says what the agent was supposed to install. Nothing says what it actually installed.

Meanwhile, the plugin ecosystem is becoming rich — and that's precisely what makes it attackable. A plugin like Understand-Anything, which turns any codebase into an interactive knowledge graph, shows the power of the model: a third party reads all of your code, with the agent's privileges. That power is exactly the attack surface.

On the enterprise side, governance is starting to catch up: AIUC just raised $55M to enforce SOC 2 for AI agents, backed by 5,000 jailbreak tests (our article). The underlying premise is right: an agent is a privileged third party, not a feature.

And in the meantime, the possible defenses — plugin controls, internal mirrors — reduce the risk without fixing the flaw, which is the vendor's responsibility, as analyst Pareekh Jain (Pareekh Consulting) summarized in InfoWorld.

How to protect yourself today

Direct answer: patch Claude Code and Codex, verify your checkouts, and treat every installed plugin as a privileged third party. On Copilot and Gemini CLI, no patch exists: surface reduction is your only option.

1. Patch, then verify the version

Claude Code ≥ 2.1.179, Codex ≥ 0.146.0. Check what's actually running on your machine:

claude --version
codex --version

2. Verify the working tree, not the pin

If you pin plugins yourself, integrate the AIR check into your pipeline:

test "$(git rev-parse HEAD)" = "<pinned-sha>" || abort

On a patched agent, this check is now automatic. On an unpatched agent, it's your only line of technical defense.

3. Take inventory of your plugins

On Copilot and Gemini CLI, the only documented user-side mitigation is to remove non-essential plugins (Pondero). Take inventory of what's installed, and remove anything that has no reason to exist.

4. Reduce the blast radius

Pandia.pro's recommendations boil down to five points: short-lived tokens, dedicated accounts, minimal permissions, logging of commands and downloads, and revocation of keys accessible to the agent. Nothing sexy — all effective.

5. Internal mirrors: take back the final say

InfoWorld cites internal plugin mirrors as an enterprise defense: hosting, on infrastructure you control, only the plugins you allow. A simple self-hosted VPS (Hostinger, check pricing on hostinger.com) is enough for a team git mirror. It doesn't fix the flaw — it gives you the final say on what enters your environment.

6. Favor what you can audit

If auditability comes first, open source agents have a structural advantage: OpenCode claims 8 million devs and 172,000 GitHub stars, and its code is readable. Some teams also run open source AI agents locally with Ollama — keeping in mind that localizing the agent doesn't fix a checkout flaw: the pattern "I trust the pin without verifying the working tree" is reproducible by any agent.

To make an informed choice of agent, cross-reference our comparison of the best AI tools for code with the status table above — and each vendor's patch status.

❌ Common Mistakes

Mistake 1: "I'm on GitHub, so I'm protected"

GitHub now blocks branches and tags that look like SHAs (The Register). But plugin marketplaces can be hosted on Bitbucket or elsewhere — and agents support them (In Plain English). GitHub's block closes one door, not the hallway. The fix, for its part, has to live in the agent.

Mistake 2: "SHA-pinning guarantees integrity"

No. The pin verifies intent — what you pinned — not the outcome — what actually landed in the working tree. Plugin4Shell is the reductio ad absurdum: the pin appears to be honored while malicious code runs. Always verify git rev-parse HEAD after a pinned checkout.

Mistake 3: "Gemini CLI is retired, so the problem is gone"

False. The npm package isn't marked deprecated and shipped 0.60.0 on September 15, 2026 (andrew.ooo). The "retired" status concerns the consumer entitlement, not the builds. Every existing installation remains exposed indefinitely (Help Net Security).

Mistake 4: "It's a model problem, let's switch LLMs"

Not at all. The flaw affects neither the model nor the prompt, but the plugin distribution layer. Switching to the best coding LLM from our comparison (best LLMs for coding) won't change anything about the checkout. It's the agent that needs patching — or replacing.

❓ FAQ

What is Plugin4Shell?

A zero-click RCE disclosed by AIR Security on September 17, 2026, affecting plugins for Claude Code, Codex, GitHub Copilot, and Gemini CLI. It hijacks the git checkout via a branch named exactly like the pinned SHA. The malicious code runs with the agent's permissions, with no action from the victim.

Is the vulnerability actively exploited?

No exploitation campaign was associated with the disclosure as of September 19, 2026, and no CVE had been assigned (andrew.ooo). But AIR's earlier work — 925 hijacked skills affecting roughly 134,000 agents — shows the attack pattern is already industrialized. The absence of public evidence is not evidence of absence.

Has GitHub Copilot been patched?

No. Microsoft received the disclosure in June 2026 and had delivered no fix as of September 19, 2026, according to the researchers and Pondero. The only documented mitigation is removing the plugins. Copilot remains exposed, including via marketplaces hosted outside GitHub, such as Bitbucket.

Will Gemini CLI be fixed?

No. Google confirmed on August 4, 2026 that no fix would be released and recommends migrating to Antigravity. But the npm package continues to be published — 0.60.0 on September 15, 2026 — and existing installations remain vulnerable indefinitely, since the fix necessarily has to live in the agent.

How can I check that my checkout is safe?

Compare the pinned SHA to the commit actually present in the working tree: test "$(git rev-parse HEAD)" = "<pinned-sha>" || abort. This is the check recommended by AIR, the one Anthropic and OpenAI implemented in their agents. On a patched version of Claude Code or Codex, the check is automatic.

Should I stop using coding agents?

No, but change your mental model: an agent is a privileged third party with access to code, credentials, and sometimes production. Patch, restrict permissions, log, remove non-essential plugins. The productivity gain remains real — provided hygiene follows, and the vendor patches.

✅ Conclusion

Plugin4Shell sums up agent security in 2026: one distribution flaw, four vendors notified in June, two patches, one deprecation, and silence — while the most widely deployed agent in the Fortune 500 still has no fix. If you're choosing an agent today, weigh plugin governance as much as the benchmark: start with our selection of the best AI agents, then check each one's patch status.