AI-generated editorial illustration; not a documentary photograph.
A vulnerability dubbed Plugin4Shell can let a plugin repository owner replace code pinned to a reviewed commit in Claude Code, Codex, GitHub Copilot and Gemini CLI, according to security firm Air Security. The firm says Anthropic addressed the issue in Claude Code 2.1.179 and OpenAI fixed it in Codex 0.146.0, while Copilot remains unpatched and Google does not plan to patch the retiring Gemini CLI.
Pinned Code Can Resolve Elsewhere
The affected agents retrieve plugins from Git repositories but, Air says, fail to verify that the installed code matches the expected commit hash. On hosts that permit a branch name resembling a hash, a repository owner can make Git resolve the pinned identifier as a movable branch, allowing different code to be installed while the agent continues to report the reviewed version.
Exposure Depends on the Host
GitHub prohibits branch and tag names that resemble commit hashes, so the branch-name technique does not affect plugins hosted there. The Hacker News found on September 18 that Anthropic's community catalog and the default Claude Code and Copilot catalogs used GitHub repositories. External catalogs hosted on Bitbucket or private Git servers may remain exposed where such names are accepted.
Gemini CLI has a separate reported path involving a repository whose main branch is named FETCH_HEAD. GitHub's restriction does not clearly exclude that name, so GitHub hosting has not been established as protection for Gemini CLI plugins.
Plugin Privileges Raise the Stakes
Air says replaced plugin code would run with the user's access, potentially reaching local files, stored credentials and connected systems. Background updates could replace an already trusted plugin without another prompt, although default automatic updates in Claude Code and Codex apply only to their built-in, GitHub-hosted marketplaces; updates from outside marketplaces are off or optional.
No Known Exploitation
Air says it demonstrated the attack against all four agents in May and notified vendors in June. As of September 18, The Hacker News found no assigned CVE, vendor security advisory or evidence of real-world exploitation. It also remains unclear whether upgrading removes any plugin already swapped or only prevents future replacements. Because validation occurs inside each agent, the report says marketplaces cannot deliver the necessary client-side fix.
Source: Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents
SIGNAL TITANS
Leave a Reply