Your coding agent can be hijacked by a plugin update you never clicked

On Thursday 17 September, three researchers at Air, a security startup that came out of stealth this month and sells protection for AI agents, published a vulnerability they call Plugin4Shell. The name is a nod to Log4Shell, the 2021 bug in a common logging library that let attackers run code on millions of servers. Air's claim is that the four most-used AI coding agents (Anthropic's Claude Code, OpenAI's Codex, Microsoft's GitHub Copilot and Google's Gemini CLI) all share one design flaw in how they install plugins, and that the flaw allows "zero-click remote code execution": an attacker can run their own code on your computer without you clicking, approving or installing anything.

Coding agents are the tools this community uses every day. You type what you want, the agent writes and runs code on your machine. To extend what they can do, each agent has a marketplace of plugins and skills (small packages of instructions and scripts) that anyone can publish and anyone can install. Because a plugin runs with the same access as the agent, and the agent typically has access to your files, your terminal and your login tokens, a malicious plugin is as bad as a malicious program.

The industry's defence against a plugin turning bad after you install it is called SHA pinning. When a marketplace approves a plugin, it records the exact version as a 40-character fingerprint (a commit hash, in git's terms). Your agent is supposed to install precisely that version, forever, no matter what the author does to the repository afterwards. Air's finding is that the agents ask for the pinned version but never check what they actually received. In the researchers' words: "the agent checks out the exact commit the marketplace pinned but never verifies it landed there".

Air says it found the bug in May, reported it to all four companies in June, and confirmed fixes from Anthropic on 17 June (Claude Code 2.1.179) and from OpenAI on 12 August (Codex 0.146.0). It says Google told it on 4 August that no fix would ship because the Gemini CLI is deprecated, and that Microsoft never responded. The Register, which reported the story on Thursday night, said Microsoft did not immediately answer its questions either.

Git, the system nearly all code is stored in, identifies every saved version by a fingerprint like aaaa...aaaa. It also lets you give human names to branches, such as main or fix-login. Here is the flaw: git allows a branch to be named with 40 hexadecimal characters, exactly the shape of a fingerprint. When you ask git to check out something that is both a valid branch name and a valid fingerprint, it picks the branch and prints only a small warning that the name is ambiguous.

So the attack goes like this, per Air's write-up. An attacker controls a plugin repository, either because they published a harmless plugin themselves or because they took over someone else's. The marketplace has pinned the plugin at fingerprint bbbb...bbbb. The attacker creates a branch literally named bbbb...bbbb, fills it with malicious code, and makes it the repository's default branch. The next time an agent installs or updates the plugin, it runs git checkout bbbb...bbbb, git hands it the branch instead of the commit, the malicious code lands on disk, and the agent reports that it installed the pinned version. The original, honest commit can still exist untouched. Gemini CLI uses a slightly different install sequence and falls to a variant of the same idea, a default branch named FETCH_HEAD.

The fix is one line. After the checkout, ask git what version is actually in the working directory and refuse to continue unless it matches the pin. Air points out this check has to run inside the agent on your computer, because that is where the pin is resolved. No marketplace can enforce a guarantee the agent itself does not check.

What makes it zero-click is auto-update. Claude Code and Codex refresh installed plugins in the background by default. If a marketplace bumps a plugin's pin to a new version (say the attacker ships a genuine improvement first, then rug-pulls the new pin), every agent that already has the plugin installed fetches the poisoned branch without any prompt. The victim did everything right: installed a reviewed plugin from a marketplace they trust, and never touched it again.

If you use Claude Code and your version is 2.1.179 or later, you are protected. That release went to npm on 16 June; the current version, as of this morning, is 2.1.278. Claude Code updates itself, so almost everyone is on a safe version already. The same self-updating behaviour that makes the bug zero-click is what patched most users three months before the bug was public. Codex users need 0.146.0 or later, published 29 July; the current release is 0.155.1. Run claude --version or codex --version if you want to be sure.

GitHub Copilot users have no patch to install. Air says it reported the same flaw to Microsoft in June and got no answer, and it attributes the silence to "the amount of disclosure volume they're currently getting". Gemini CLI users are in a worse spot: Google has retired the tool and told Air it will not fix it, so every install stays vulnerable. Google's advice, relayed by Air, is to move to Antigravity, its newer development environment, which does not have a marketplace pin to bypass.

GitHub pushed back on Thursday. A spokesperson told The Register that "GitHub does not allow users to create branch or tag names that resemble commit SHAs", so the attack cannot be carried out on repositories GitHub hosts, which covers the large majority of plugin marketplaces. Air accepts that point and makes two replies: the agents officially support marketplaces hosted elsewhere, including Bitbucket and self-hosted git servers, which do allow such branch names, and Anthropic's own documentation lists those as valid backends. In other words, GitHub's rule is a real mitigation, and it is not the same as a fix in the agent.

One thing to keep in mind while reading all this: Air is a vendor. Its post ends with a demo booking button and notes twice that its own marketplace product was not affected. That does not make the finding wrong. Two of the four companies confirmed and patched it, and the git behaviour it relies on is documented. It does mean that phrases like "millions of agents affected" describe who could be reached, not anyone who was. Air has not reported this being exploited in the wild.

Supply-chain attacks on developer tools are not new. In 2018 the maintainer of a popular JavaScript package called event-stream handed it to a stranger who quietly added code to steal cryptocurrency wallets; it was downloaded millions of times before anyone noticed. In 2020 attackers planted a back door in a software update from SolarWinds that reached about 18,000 organisations. In 2024 a years-long effort to insert a back door into xz, a compression tool inside most Linux systems, was caught by one engineer who noticed a half-second slowdown. The lesson each time was the same: you are only as safe as the least careful link in the chain of code you download.

Pinning was the industry's answer to exactly those stories. Review a version, record its fingerprint, and never accept anything else. What is new about Plugin4Shell is that it is a failure of that safeguard itself, not of a marketplace or a maintainer. The reviewed pin was honoured on paper and bypassed in practice. That is why Air argues no marketplace policy can fully close it.

The second new element is the target. A compromised JavaScript library runs inside one application. A compromised plugin runs inside an agent that has been granted your terminal, your files and often your cloud credentials, and that many people run with permissions relaxed so it does not keep asking. Air's earlier research, which we have not verified independently, claims it got a malicious skill installed on 26,000 agents and hijacked the repositories behind 925 existing skills reaching 134,000 agents. Whatever the exact numbers, the shape is clear: the agent is now the most privileged program on a developer's laptop, and its plugin system is the newest way in.

Think of a pharmacy that fills repeat prescriptions by delivery. Each medicine has a product number, and the pharmacist's rule is to dispense only the exact product number on the prescription. But the assistant who fetches the box goes to the shelf, picks up whatever is in the slot with that number on its label, and never reads the number printed on the box itself. Someone who can reach the shelf only has to relabel a slot. The prescription is correct, the paperwork says the right product was dispensed, and a different box goes out the door. Because it is a repeat prescription, it goes out every month without anyone at home ordering it again.

The fix is not a better shelf or a stricter label rule. It is the assistant reading the number on the box before it leaves. That is what Anthropic and OpenAI added.

If you use Claude Code or Codex, check your version once (claude --version, codex --version) and make sure auto-update is on. Both current releases are well past the patched versions. If you use GitHub Copilot with plugins from a marketplace that is not on GitHub, treat those plugins as unverified until Microsoft ships a fix. If you still use Gemini CLI with marketplace plugins, stop, and move to whatever Google recommends.

For everyone: look at what plugins and skills you have installed and remove the ones you do not use. Each one is code that runs with your agent's permissions, updated by someone you have probably never met. The convenience of a marketplace is real, and so is the cost, and this week the cost got a name.

Three things to watch. Whether Microsoft ships a Copilot fix now that the flaw is public. Whether any marketplace reports an actual rug-pull using this technique, which would move it from a proof of concept to an incident. And whether the agents start treating plugin auto-update the way phones treat app updates, with a visible log of what changed and when.