Plugin4Shell is the name of a vulnerability that AI security firm AIR Security disclosed on 17 September 2026. It affects four of the most widely used AI coding tools, namely Anthropic’s Claude Code, OpenAI’s Codex, GitHub Copilot and Google’s Gemini CLI. On 21 September the German tech news site heise picked up the story as well.
The flaw sits in the way these tools load plugins. A plugin that was reviewed and installed once can later be swapped for malicious code without anyone noticing. That code then runs on the developer’s machine with the same permissions as the person working on it.
Two of the four vendors closed the hole months ago. The other two have not shipped a fix. If you work with one of these tools, or someone works with one on your behalf, three things are worth checking, namely the version, the installed plugins and where those plugins come from.
What happens in Plugin4Shell
AI coding tools can be extended with plugins. A plugin might add extra commands, connections to external services or custom workflows. Plugins are found and installed through marketplaces, which are catalogues listing the available plugins and where their code lives.
To stop a reviewed plugin from being changed behind your back, the catalogues do not simply point to a plugin’s repository. They point to one specific state of it. That state is identified by a commit hash, a 40 character checksum that Git assigns to every saved version of a project. This is called SHA pinning. The idea is that exactly this one reviewed version gets installed, whatever happens in the repository afterwards.
AIR Security showed that all four tools request this pinned state but never check whether the downloaded code actually matches it. The attack takes two steps. First the plugin receives a harmless update, the catalogue reviews it and records the new checksum. Then the attacker creates a branch in the repository named exactly like that checksum, fills it with malicious code and makes it the default branch. When a branch and a commit share a name, Git prefers the branch. So the tool fetches the malicious code while the checksum in the catalogue still looks correct.
It is called zero-click because nobody has to click anything. The tools update installed plugins in the background, and according to AIR that is the default in Claude Code and Codex. A plugin you trust and installed long ago is replaced by a malicious version without a single prompt.
Photo: tom analogicus / Pexels
There are two ways to gain control of a plugin repository. Someone publishes a plugin that is harmless at first, gets it accepted into a catalogue and adds the malicious code later. Or someone takes over the repository of an existing plugin. The swapped code then runs with the same access rights as the person at the keyboard. It can read files, grab stored credentials and reach everything that machine is connected to.
One limitation makes the situation easier to assess. The trick only works on Git hosts that allow branch names shaped like a checksum. GitHub rejects such names. Bitbucket and any self-hosted Git server allow them, according to AIR Security, and the tools support exactly these sources for catalogues and plugins.
Which versions are affected
| Tool | Affected up to | Fixed in | Status as of 21 Sep 2026 |
|---|---|---|---|
| Claude Code (Anthropic) | all versions before 2.1.179 | 2.1.179, released 16 June 2026 | fixed |
| Codex (OpenAI) | all versions before 0.146.0 | 0.146.0, released 29 July 2026 | fixed |
| GitHub Copilot (Microsoft) | all versions | no fix | open |
| Gemini CLI (Google) | all versions | no fix planned | open, tool is being retired |
Anthropic published the fixed version on 16 June 2026 and confirmed the fix to AIR Security a day later. The release notes for 2.1.179 do not mention it. Codex 0.146.0 came out on 29 July 2026, and AIR verified the fix on 12 August.
GitHub Copilot is a different story. AIR notified Microsoft in June, and as of 21 September 2026 no fix has shipped. Plugins from GitHub repositories are protected against this variant because GitHub does not allow the required branch names in the first place. Copilot can also install plugins from other sources, though, and that is where AIR sees the risk.
Gemini CLI is a special case. On 19 May 2026 Google announced that it would replace it with the new Antigravity CLI. Since 18 June 2026 Gemini CLI no longer serves requests for the free tier or for Google AI Pro and Ultra subscribers. On 4 August Google confirmed to AIR that no fix will ship. According to Google, organisations with a Gemini Code Assist Standard or Enterprise licence or access through Google Cloud can keep using Gemini CLI. None of the sources says whether that still maintained version closes the hole. According to AIR, the attack does not reach Antigravity CLI because it has no comparable pinning for marketplace plugins.
How to check your installation
Each of the four tools shows its version with a single terminal command:
claude --version
codex --version
copilot version
gemini --versionClaude Code needs to report at least 2.1.179, Codex at least 0.146.0. If yours is lower, update it through whatever channel you used to install it. Claude Code has a built-in claude update command, the Copilot CLI has copilot update.
I work with Claude Code every day. The installation I use for that reports version 2.1.275, well past the version with the fix.
Take a second look if a tool ended up on your machine through more than one route, say through npm, through the native installer and through a desktop app that ships its own copy. You may then have several versions side by side. The terminal command only reports the one found first on your path, so an old installation that no longer updates itself is easy to miss. If you no longer need it, uninstall it.
Photo: cottonbro studio / Pexels
Review your plugins and automatic updates
These commands list the installed plugins and the configured catalogues:
claude plugin list
claude plugin marketplace list
copilot plugin list
copilot plugin marketplace list
gemini extensions listIn Codex, typing /plugins inside the CLI opens an overview that marks installed plugins. Gemini CLI calls its plugins extensions.
Two questions matter for every entry. Do you still need the plugin? Anything you no longer use should go, because every installed plugin is one more door into your system. And where does it come from? Catalogues and plugins hosted on github.com are not affected by the variant described here. Anything on Bitbucket or a self-hosted Git server deserves a closer look, and even more so with Copilot as long as no fix is out.
Automatic updates are worth a look too. According to its documentation, Claude Code automatically updates the official Anthropic catalogue and most other official Anthropic catalogues, while third-party catalogues are not updated automatically by default. You can switch this per catalogue in the Marketplaces tab under /plugin. On 18 September The Hacker News checked that every plugin in Anthropic’s community catalogue and in the default catalogues of Claude Code and Copilot points to a GitHub repository. If you only use plugins from those catalogues, the described variant can hardly reach you. Updating is still part of the job, because any catalogue can change at any time.
The pattern is familiar from software supply chain attacks. A component you once trusted changes later, and an automatic mechanism pulls the change into your system without asking. For npm packages, one countermeasure is a waiting period before updates, which I described in my post on the Dependabot cooldown. The same caution applies to plugins in AI coding tools. Anthropic’s own documentation states that plugins and marketplaces can execute arbitrary code on your machine with your user privileges. Only install what comes from a source you trust.
What to ask your agency or freelancer
Even if nobody in your company uses these tools directly, Plugin4Shell can still concern you. Whoever builds software for you, an agency, a freelancer or your own team, may well be using one of them. Their machines often hold access to your systems, such as your hosting, your code repository or the APIs of your services. Malicious code on such a machine therefore reaches your project too.
Three questions are enough for a short conversation:
- Which AI coding tools do you use on my project, and in which version?
- Where do the installed plugins come from, and do they update automatically?
- Is anyone still using Gemini CLI, or Copilot with plugins from sources outside GitHub?
Anyone who works carefully with these tools can answer that in a few minutes. If you also want to know how secure the code of your project itself is, my post on finding vulnerabilities with AI describes a structured way to check it.
Photo: Nathan Thomas / Pexels
Putting it in perspective
No case of Plugin4Shell being exploited in the wild is known so far. For Claude Code and Codex, an update settles the matter, and the version command tells you in seconds whether it has arrived. For Copilot and Gemini CLI the hole stays open. There, the only remedies are caution about sources and, in the case of Gemini, moving on.
Beyond the individual case, Plugin4Shell shows how far these tools have come. AI coding tools have turned into platforms with their own ecosystems. That puts them in the same maintenance category as browsers, package managers and operating systems. You keep them updated, use extensions sparingly and know where they come from.
If you are unsure whether the AI tools in your project or at your service provider are up to date, drop me a line and I will go through it with you.
FAQ
What is Plugin4Shell?+
Plugin4Shell is a vulnerability in AI coding tools that AIR Security disclosed on 17 September 2026. The tools are supposed to lock plugins to a reviewed version, but after downloading they never check whether the code actually matches that version. Anyone who controls a plugin's repository can therefore ship malicious code that lands on the machine through the automatic plugin update and runs there without any prompt.
Is my Claude Code version affected by Plugin4Shell?+
Run claude --version in your terminal. Version 2.1.179 from 16 June 2026 and everything after it is fixed, all older versions are affected. If you installed Claude Code in more than one way, for example through npm and through the native installer, check each installation separately, because the command only reports the one found first on your path.
What can I do if I use GitHub Copilot?+
As of 21 September 2026 there is no fix. The attack only works with plugins whose repository lives on a Git host that allows branch names shaped like a commit hash, and GitHub rejects those. Running copilot plugin marketplace list and copilot plugin list shows which sources are configured. Remove marketplaces and plugins hosted outside GitHub until Microsoft ships a fix.
Has Plugin4Shell been used in real attacks?+
No case of actual exploitation is known so far. AIR Security demonstrated the attack with a working proof of concept against all four tools and notified the vendors in June 2026. The details were only published in September to give the vendors time to respond.
Want to know more?
In a free intro call we discuss how you can use these topics for your company. Not a sales pitch, but an honest assessment.
Book a free intro call
