If you're a developer using an AI coding agent with plugins installed, this week's security news deserves five minutes of your attention. On September 17, researchers at Air, a security startup focused on protecting enterprise AI agents, disclosed Plugin4Shell — a zero-click vulnerability that they describe as a first-of-its-kind AI supply-chain attack. It affects every major coding agent on the market, and here's the uncomfortable part: the people most at risk are the ones who did everything right.
01.What is Plugin4Shell?
In one line: it's a bug that lets an attacker swap a trusted plugin for a malicious one and have it silently auto-installed on your machine — no clicks, no prompts, nothing you'd ever notice. The researchers found it in May 2026, built working proof-of-concept exploits against all four agents, and reported it to every vendor in June under coordinated disclosure. The reason it's making headlines now is the uneven response: two companies patched, one declined, and one can't patch at all.
What makes this scarier than a normal bug is the blast radius. A malicious plugin inherits the same permissions as the developer running the agent — access to source code, environment variables, API keys, production systems. Air's researchers put it bluntly: the attacker gets the same reach over the company's assets as the employee does.
02.How the attack works (in plain English)
Plugin marketplaces use something called SHA pinning to keep plugins safe. When a plugin passes review, the agent locks it to one specific commit hash — an immutable snapshot of the code. The idea: even if the plugin's repository gets compromised later, your agent keeps running the exact reviewed code you pinned.
Plugin4Shell defeats that. The agent checks out the pinned commit but never verifies that the checkout actually landed there. An attacker who controls the plugin's repository — say, a branch named to look like a commit hash, or Gemini CLI's variant involving the fetch mechanism — can make the checkout resolve to their own malicious code while the pin still looks honoured on your side. The agent even reports a successful install at the pinned commit.
And because Claude Code and Codex auto-update installed plugins by default, the swap reaches machines with zero user action. You don't have to install anything shady. The benign plugin just has to already be there.
03.Who fixed what — and who didn't
Anthropic patched Claude Code in version 2.1.179. OpenAI patched Codex in 0.146.0. Both fixes shipped after Air's disclosure, and if you're on those versions or later, you're covered.
Microsoft is the odd one out. GitHub's position is that Plugin4Shell doesn't affect it because GitHub blocks branch and tag names that resemble commit SHAs. Air's researchers dispute this — Copilot also supports marketplaces hosted on Bitbucket and self-hosted git servers, which don't have that protection. As of now, Copilot users have no patch.
Google took the most drastic route: it deprecated Gemini CLI entirely and told Air it will not patch, which means every existing install stays vulnerable for good. Google's advice is to migrate to Antigravity, its newer agentic development environment, which this attack can't reach. If you caught our coverage of Claude Code's new multi-agent Projects feature or Google locking its strongest cyber model behind the Fairwind Program, you'll notice the pattern — the whole industry is grappling with how much power to hand agents, and security is arriving after the fact.
04.Why the scale should worry you
This isn't theoretical. In earlier research, Air built a benign-looking plugin, watched it go viral, and found it had reached over 26,000 agents before being pulled. In separate work the team calls SkillJacking, they found 925 skills already in active use had been hijacked away from their original maintainers — reaching about 134,000 agents. Takeovers happen at scale; Plugin4Shell is the missing link that defeats the mechanism built to contain them.
Honestly, what surprised me most is how little attention the plugin layer gets. Everyone argues about model safety and alignment, while the boring plumbing — git checkouts and commit hashes — quietly becomes the weakest link in the chain.
05.What you should do right now
Update Claude Code to 2.1.179 or later and Codex to 0.146.0 or later — that's the complete fix where one exists. If you're on Copilot, audit your installed plugins, remove anything you don't actively use, and consider disabling auto-update until Microsoft ships a fix. If you still have Gemini CLI installed, treat it as permanently vulnerable and migrate. And if you work at an Indian startup where the same laptop has production keys, customer data, and a coding agent with twenty plugins — this is the week to check versions, not next quarter.
One more thing worth internalising: the guide we keep recommending to readers, GPT-6 Astra — Zero to Hero Guide, has a full chapter on AI safety, including how to think about the permissions you hand an agent — which is exactly the discipline a bug like this exploits when it's missing.
Key Takeaways
- Plugin4Shell = zero-click RCE via a plugin SHA-pinning bypass, affecting Claude Code, Codex, GitHub Copilot, and Gemini CLI
- Auto-update (default in Claude Code and Codex) is what makes it zero-click
- Patched: Claude Code 2.1.179, Codex 0.146.0. Unpatched: Copilot. Won't fix: Gemini CLI (deprecated, migrate to Antigravity)
- Air's earlier research showed hijacked skills already reaching 134,000 agents
- Only an agent-side update fixes it — no marketplace can protect you on its own
Frequently Asked Questions
What is Plugin4Shell?
Plugin4Shell is a zero-click remote code execution flaw disclosed by security startup Air on September 17, 2026. It affects all four major AI coding agents — Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI — and quietly breaks the SHA-pinning safety mechanism meant to keep plugins trustworthy.
Which AI coding agents are affected, and have they been patched?
All four major agents are affected. Anthropic and OpenAI have already shipped patches; Microsoft had not at the time of disclosure, and Google deprecated Gemini CLI without one.
How do I fix Plugin4Shell?
Update the coding agent itself. Because the flaw lives in the agent's own plugin-trust mechanism, marketplaces cannot patch it for you — only a full agent update closes the hole.
What This Means for You
For Indian developers and startups, this is the first real taste of a problem that's only going to grow: AI agents have become infrastructure, and infrastructure gets attacked at its supply chain. The teams that stay safe won't be the ones who never install plugins — that's not realistic — but the ones who treat agent permissions, plugin audits, and version hygiene as seriously as they treat their CI/CD pipeline. If you're building with agents and want that discipline built into your workflow from day one, the GPT-6 Astra — Zero to Hero Guide covers agents, safety, and cost control in one structured roadmap. Update your tools this weekend; it takes ten minutes.