Plugin4Shell Flaw Allows Malicious Code Swap in Four AI Coding Agents

Vulnerability Discovered in AI Coding Agents

Security firm Air Security identified a flaw, named Plugin4Shell, in four widely used AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot, and Google's Gemini CLI. The vulnerability allows an attacker who controls a plugin's code repository to replace a legitimate plugin with a malicious one, even if the agent is configured to use a specific, reviewed version.

Mechanism of the Attack

AI agents install plugins from online marketplaces, which typically lock each plugin to a specific version using a commit hash. Air Security found that while agents fetch the snapshot, they do not verify that the installed code matches the commit hash. On code hosts that permit branch names resembling commit hashes (e.g., Bitbucket or private Git servers), a repository owner can point such a branch name to different code. The agent then installs this altered code while still reporting the original, locked version.

The swapped code runs with the same permissions as the user, potentially gaining access to files, saved credentials, and connected systems.

Patches and Unresolved Issues

Anthropic has patched the flaw in Claude Code 2.1.179, and OpenAI has addressed it in Codex 0.146.0. However, GitHub Copilot currently has no fix. Google announced it will not patch the Gemini CLI, as it is being retired. GitHub's documentation states that it does not allow branch or tag names that resemble commit hashes, which prevents the branch trick on GitHub repositories for most agents. However, the Gemini CLI's installer can be tricked by a main branch named FETCH_HEAD, a name not clearly blocked by GitHub's rules, meaning its plugins from GitHub might still be vulnerable.

Potential Impact and Mitigation

The vulnerability's impact is heightened by features like background auto-updates, which could allow a malicious plugin to be installed or updated without user interaction. While GitHub's naming conventions offer some protection for plugins hosted there, the flaw remains a concern for agents using other code hosts or those with specific installer vulnerabilities like the Gemini CLI.