Your AI coding agent is running plugins right now. It probably installed some of them automatically, without a prompt, because auto-update is on by default. And if one of those plugins came from a marketplace an attacker quietly compromised after the security review, you have code running on your machine that you never approved. That is Plugin4Shell — a SHA-pinning bypass that turns the trust mechanism itself into the attack vector. Anthropic and OpenAI have patched. Microsoft has not. Google deprecated the affected product and will not patch.
What Is Plugin4Shell #
Plugin4Shell is a zero-click remote code execution vulnerability in the plugin ecosystems of the four major AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. Disclosed on September 17 by security startup Air Security, the vulnerability was reported to all four vendors in June 2026 under a 90-day responsible disclosure window.
The flaw lives in the agents themselves, not in the marketplaces that host plugins. That distinction matters: no marketplace can ship a fix. Only an agent update stops it.
How the SHA Pin Check Fails #
AI coding agent marketplaces use SHA pinning to lock plugins to a specific commit hash — the security guarantee that you get exactly the code that passed review, not some later replacement. The problem is that agents verify whether they fetched the right hash without verifying whether the fetched content actually matches that hash. An attacker who controls the plugin’s repository can make the git checkout resolve to malicious content while the hash check still passes on the agent side.
Two attack paths exploit this. In the first, an attacker submits a clean plugin, waits for it to pass review and get pinned, then replaces the content after the fact — the marketplace still shows the original hash, the check still passes, and the malicious version auto-installs. In the second, an attacker hijacks a legitimate plugin author’s repository through credential or token theft, pushes malicious code that passes the same check, and delivers it to every agent with that plugin installed.
In both cases, because auto-update is the default, no user action is required. The update arrives silently.
Patch Status by Vendor #
| Agent | Status | Patched Version | Required Action |
|---|---|---|---|
| Claude Code | Patched | 2.1.179+ | Update now |
| OpenAI Codex | Patched | 0.146.0+ | Update now |
| GitHub Copilot | Unpatched | — | Audit plugins, disable auto-update |
| Gemini CLI | Won’t fix (deprecated) | — | Migrate to Antigravity |
Microsoft’s position deserves scrutiny. GitHub stated that Plugin4Shell attacks do not affect GitHub because GitHub blocks branch and tag names that resemble commit SHAs. Air Security’s researchers point out this protection only covers GitHub-hosted marketplaces. Copilot supports marketplaces hosted on Bitbucket, GitLab, and self-hosted platforms — none of which have that protection. The vector remains open.
Google deprecated Gemini CLI and told Air Security it will not ship a patch. Users should migrate to Antigravity, Google’s newer agentic development environment, which is not affected.
What to Do Right Now #
If you run Claude Code or Codex, update immediately:
claude --version
npm update -g @anthropic-ai/claude-code
codex --version
npm update -g @openai/codex
If you use GitHub Copilot, there is no patch yet. The mitigations available to you are limited but worth doing: audit the list of plugins you have installed, remove any you do not actively use, and consider disabling auto-update until Microsoft ships a fix. Reducing the installed plugin surface is the only meaningful defense right now.
If you still have Gemini CLI installed, treat it as permanently vulnerable. The migration path is Antigravity.
This Is Worse Than npm #
Supply chain attacks on package registries are a known problem. The difference with AI coding agent plugins is the install model. When you add an npm package, you made a conscious decision: you ran a command, updated a lockfile, reviewed (or chose not to review) a diff. With AI coding agent plugins, the agent can select and install dependencies autonomously, and auto-update propagates changes to every install without a human in the loop.
2026 has already logged 1,184 malicious skills poisoning an agent marketplace in February, an OpenAI plugin ecosystem breach that pulled credentials from 47 firms, and a growing body of research showing that agent skill ecosystems have no equivalent of npm audit or Dependabot. Plugin4Shell is the formal proof of concept that the attack surface is real and the trust model is broken.
The OWASP Agentic Skills Top 10, published four days ago, includes plugin supply chain compromise as a top-tier risk. The timing is not a coincidence — this category of attack has been building all year. Plugin4Shell is its clearest demonstration yet.
Check your version. Today. And if you manage a team, add agent version checks to your security baseline before someone else makes that decision for you.