TheModelDesk

AIR Security says Plugin4Shell can make a coding agent download and execute attacker-controlled code without user interaction. The affected products are Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI. The attack uses manipulated marketplace plug-ins that agents load automatically. No confirmed exploitation case is known.

The agents request a 40-character SHA fingerprint for the marketplace-approved commit. They do not verify that the downloaded code produces the same hash. An attacker with access to a legitimate plug-in repository can create a branch named after the pinned fingerprint, place malicious code in it and set that branch as the default. During an automatic update, the agent follows the branch and executes the code.

An attacker can also publish a harmless plug-in, obtain a marketplace fingerprint and add malicious content later. The technique works on marketplaces that allow branch names resembling commit hashes. GitHub rejects such branch names. AIR Security identifies marketplaces on Bitbucket, GitLab and self-hosted Git servers as vulnerable.

AIR Security found the flaw in May 2026 and delayed publication to give the affected companies time to respond. Anthropic, OpenAI, Microsoft and Google received the information in June 2026. Microsoft had not responded when AIR published its findings. Heise Developer asked GitHub for a statement.

Anthropic fixed Claude Code in version 2.1.179, released on GitHub on June 16. AIR Security confirmed the fix in OpenAI Codex version 0.146.0 at the beginning of August. GitHub Copilot still had no fix at the time of the report.

Google told the researchers on August 4 that the consumer version of Gemini CLI would be discontinued and would receive no fix. Enterprise access through Gemini Code Assist or Google Cloud is unaffected. Google users can move to Antigravity CLI, which, according to the current assessment, has no comparable SHA-pinning mechanism for marketplace plug-ins.