Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents
A vulnerability in four AI coding agents – Claude Code 2.1.179, Codex 0.146.0, and Gemini CLI – allows attackers to swap malicious plugin code into agents, even when the agent is locked to a specific version. This is achieved by tricking the agents into installing plugins from repositories with branch names mimicking commit hashes. While the agents check the lock on the user's machine, not the marketplace, the fix requires updates to the agents themselves, and not the marketplaces. Google has retired the consumer Gemini CLI, but enterprise access continues. As of September 18th, no CVE identifier has been assigned, and vendors have not published security advisories.
A vulnerability within four AI coding agents – Claude Code 2.1.179, Codex 0.146.0, and Gemini CLI – is enabling attackers to inject malicious plugin code, bypassing version controls. The flaw stems from the agents’ reliance on repositories, where a branch name mimicking a commit hash can be used to install a different plugin than the one the agent is locked to. Air Security discovered this issue and demonstrated a working attack in May, informing the vendors in June.
Because the agents check the lock on the user’s machine, not the marketplace, a fix cannot be applied at the marketplace level. The vulnerability is particularly concerning because the agents automatically update installed plugins, potentially replacing trusted plugins with malicious ones without user intervention. Google has retired the consumer Gemini CLI, but enterprise access continues, and Google has been directing users to Antigravity.
GitHub Copilot is not directly vulnerable because GitHub prevents branch names resembling commit hashes. However, the Gemini CLI is vulnerable, and Microsoft has not yet released a fix. As of September 18th, no CVE identifier has been assigned, and none of the four vendors have published a security advisory. The vulnerability was initially discovered in May and has not been observed in real-world attacks. Google’s fix for Codex 0.146.0 addresses the same underlying Git behavior, where a requested commit SHA can be interpreted as a branch name, leading to a plugin materializing a different commit than the one it was pinned to.
Air Security’s research highlights the potential for significant risk, particularly for users relying on the agents’ default, GitHub-based marketplaces. The vulnerability underscores the importance of agent updates and careful selection of plugin sources.