Analysis
AIR Security researchers Or Nevo, Dor Granat and Niv Hoffman disclosed Plugin4Shell, a zero-click remote code execution vulnerability affecting Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI, on September 17, according to The Register and Help Net Security.
How The Exploit Actually Works
The vulnerability breaks SHA pinning, the mechanism developers use to lock an installed plugin to a specific, reviewed version of its code. For Claude Code, Codex and Copilot, an attacker can create a git branch whose name matches the plugin's 40-character commit hash; because git can prioritize a matching reference name over the underlying commit object during checkout, the agent installs the malicious branch's code while still reporting a successful installation against the expected SHA. Gemini CLI has a distinct variant of the same underlying weakness: its plugin process fetches the intended commit and then checks out a reference called FETCH_HEAD, which an attacker can hijack by naming a malicious branch FETCH_HEAD to redirect the checkout away from the actual fetched commit.
“Anthropic patched Claude Code in version 2.1.179, and OpenAI patched Codex in version 0.146.0 -- both within days of the September 17 disclosure.”
No Click Required, Full Developer Permissions
What makes Plugin4Shell more severe than a typical supply-chain bug is that exploitation requires nothing from the victim -- no click, no approval prompt, no manual reinstall. Once triggered, the malicious code runs with the same permissions as the developer's own agent session, which for most professional coding-agent users means access to local source code, cloud credentials, SSH keys, internal repositories, production systems and secrets. That is functionally equivalent to a compromised developer laptop, delivered through a plugin update most developers would never think to scrutinize.
A Real-Time Test Of Vendor Response
The four affected companies have responded very differently in the days since disclosure. Anthropic patched Claude Code in version 2.1.179, and OpenAI patched Codex in version 0.146.0 -- both within days of the September 17 disclosure. Microsoft has shipped no fix for GitHub Copilot as of this writing, and Google's response was to retire Gemini CLI entirely rather than patch the underlying flaw. Pulse has separately tracked a related flaw, GitSpawn, affecting overlapping coding agents earlier this year -- this is now the second cross-vendor plugin-security incident hitting the same category of tools within months, suggesting the plugin-installation trust model itself, not any single vendor's implementation, is the recurring weak point.
The Numbers In Context
A flaw hitting four of the most widely deployed AI coding agents simultaneously is a different order of severity than a single-product vulnerability -- these tools now sit inside a meaningful share of professional software development workflows, and "millions of agents affected," per AIR's own disclosure, is not hyperbole given how quickly these products have been adopted since 2024. That scale is exactly why the split patch response matters: two of the four affected products remain exploitable in production right now.
What To Watch
Whether Microsoft ships a Copilot fix, and how long Google leaves Gemini CLI users without a supported replacement that addresses the underlying checkout-validation flaw, will determine how much real-world exposure persists beyond this disclosure. For any team running these agents in CI/CD or with access to production credentials, the immediate action is auditing which plugin sources are trusted and whether SHA pinning is the only control in place -- this disclosure demonstrates that control alone is not sufficient.