The security company Air Security disclosed the vulnerability Plugin4Shell on September 18, 2026: It bypasses the checksum verification of AI coding agents and injects unverified code into four widely used tools. Affected are Claude Code, OpenAI Codex, GitHub Copilot, and Google Gemini CLI, with two providers having already closed the gap and two not yet.
Manipulated Git branches bypass checksums
AI coding agents often install plugins via a SHA checksum, which is supposed to define exactly one verified code version. In the report by Air Security, the affected systems do check whether a suitable commit exists, but do not verify that it is actually checked out. Therefore, an attacker can create a branch whose name exactly matches the forty-character SHA hash that Git prefers during checkout before the actual commit object. The trick works through this mechanism for Claude Code, Codex, and GitHub Copilot.
In Gemini CLI, the gap uses a second variant: The command git fetch —ref does not check the retrieved commit ID, allowing a branch named FETCH_HEAD to replace the expected version. According to Air Security, two attack vectors are conceivable. A plugin initially passes the review of a marketplace and is only later replaced, or an attacker takes over the repository of an already established plugin and uses the same trick there. In both cases, the exchange remains invisible because the checksum in the log still appears correct.
Anthropic and OpenAI patch, two providers remain vulnerable
Anthropic and OpenAI responded with updates: Claude Code has closed the gap since version 2.1.179, Codex since version 0.146.0. No fix is currently available for GitHub Copilot. According to a report by InfoWorld, GitHub only blocks branches with SHA-like names hosted on its own platform; self-hosted Git servers remain unaffected.
Google no longer patches Gemini CLI because the tool is considered outdated and instead refers users to the successor platform Antigravity. Anyone using one of the unpatched tools productively is working with an open attack surface for malicious code that runs with the same rights as the coding agent itself. This can affect source code, SSH keys, credentials, and production systems.
Additionally, automatic plugin updates are enabled by default in Claude Code and Codex. Affected organizations therefore had to actively switch to the patched versions instead of relying on automatic protection. Those operating Copilot or Gemini CLI with plugins from third-party sources bear the risk themselves until a manufacturer solution is provided.
Researchers see risk even for careful organizations
Air Security describes Plugin4Shell as the first supply chain vulnerability of this kind in the ecosystem of AI agents. The team had previously shown that a single malicious plugin could reach up to 26,000 agents. Furthermore, the researchers claim to have identified 925 compromised skills with reach to 134,000 agents, a number that is not independently verified. The core of the warning: an attacker can initially sneak a plugin through the marketplace review and only later, after the checksum is confirmed, replace it in the background.
“Doing the right thing does not protect you,” writes Air Security in its report. Even organizations with established release processes are therefore vulnerable because trust is placed in the wrong place.
Market analyst Pareekh Jain states to InfoWorld that especially companies with third-party plugins in AI coding agents are particularly exposed. The responsibility for thorough verification lies with the manufacturers, not with individual marketplaces. The gap thus joins a growing number of similar findings in AI coding agents, such as the recently disclosed GitSpawn vulnerability, which also exploited prepared Git references.
It will be crucial whether GitHub and Google follow the example of Anthropic and OpenAI or whether users will have to rely on their own caution regarding plugin updates permanently. Until then, especially companies with high Copilot or Gemini CLI prevalence have an open gap that cannot be closed through careful code reviews but only through a patch from the manufacturers themselves.
