AIR published Plugin4Shell, and the plugin commit pins in four coding agents go unverified#
What happened: AI security firm AIR disclosed Plugin4Shell on September 17. Claude Code, Codex, GitHub Copilot, and Gemini CLI each pin a plugin to a specific commit without checking that the code on disk is the commit they asked for. AIR
The pin is correct and the code is not: When a marketplace pins a plugin to a commit it has reviewed, the agent checks it out and skips verifying the result. An attacker who controls the plugin repository renames the default branch to the same 40-character hex string as the pinned hash and fills that branch with malicious code. Git resolves a branch name before a commit hash, so the check passes and the malicious code lands. Help Net Security
Why it is zero-click: Installation is not the only window. The same git checkout runs again during a plugin’s background auto-update, which ships on by default in Claude Code and Codex. When the marketplace moves the pin to a new commit, an already-installed plugin swaps itself for the malicious version with no user action. Help Net Security
Where it works: Only on hosts that allow a branch name shaped like a hash. GitHub rejects 40-character hex branch names. Bitbucket and self-hosted git servers allow them. Help Net Security
The patches diverged: AIR found the flaw in May 2026, built a proof of concept that worked across all four agents, and reported it to the vendors in June. Anthropic fixed it in Claude Code 2.1.179 and OpenAI fixed it in Codex 0.146.0. Microsoft has shipped nothing for Copilot, and Google is retiring Gemini CLI instead of patching it, telling existing users to move to Antigravity. Help Net Security
Careful users are not spared: The people who took every precaution, picking a reviewed plugin from a trusted marketplace and pinning it correctly, are the ones exposed. AIR calls this the first supply chain vulnerability of the AI agent ecosystem. AIR
Pinning was never verification, and the users who pinned correctly are exposed#
The promise of pinning covered less than it sounded like: A guarantee that a reviewed version keeps running came down to one checkout instruction. Nothing in any of the four agents ever checked the result. Pinning is an old supply chain habit, and here it was used without the verification half.
The distribution layer was softer than the model: Security research on agents has aimed at the model or the agent itself. Plugin4Shell takes the layer underneath, the marketplace. Because agents run with user privileges, plugin code gets access to deployment keys, credentials, and the file system.
Four labs made the same mistake: This was a shared design choice rather than one product’s bug, which is why no single marketplace fix closes it.
Marketplaces cannot patch it themselves: The check belongs inside the agent, so only the agent vendors can fix it. The strongest move left to a marketplace is accepting only hosts that reject hash-shaped branch names, and that cuts off hosts the agents officially support.
The vendors’ answers split for the same reason: Anthropic and OpenAI shipped patch releases, Microsoft has not said when it will, and Google retired the product. One flaw, three different answers.
What to try now: update the agent and turn plugin auto-update into a manual approval#
Check the version: Run claude --version and look for 2.1.179 or later, then codex --version for 0.146.0 or later. Updating is the only complete fix.
On GitHub Copilot there is no fix yet: With no Microsoft patch, turning off auto-update and cutting back on marketplace plugins is what is left.
Verify the checkout yourself: Add one line to your install script or CI that compares git rev-parse HEAD against the expected SHA after checkout, and stop the install when they differ. The agent still does the checkout, so this is not a full defense, but it catches the swap in a pipeline.
Write a plugin inventory: Note which plugins you have, which repository each came from, and who controls that repository. A plugin pointing at someone else’s repo is an outside supplier in practice.
Teams on self-hosted git are more exposed: GitHub’s block on 40-character hex branch names shuts this path. An internal marketplace pointing at Bitbucket or a company git server leaves it open.
On Gemini CLI, plan the move: No patch is coming. Existing installs stay vulnerable and Google’s guidance is to move to Antigravity.
What is still open: Gemini CLI is permanently exposed, and another path broke open the same week#
Gemini CLI users stay exposed: The retirement decision means existing installs never get a patch. Moving to a new agent is the only option left.
A different attack landed the same week: A three-person team at security startup Hacktron AI used Claude Opus 5 to break into several OpenAI employee ChatGPT accounts and reach company software. The entry point was an image-upload flaw in the Discourse forum OpenAI runs for its developer community. The team found it on July 25, reported it, and collected a $6,500 bounty. TechCrunch
The cost of attacking is already low: Matt Fredrikson of AI security firm Gray Swan told TechCrunch that $200 a month buys anyone tools capable of breaking into a company like OpenAI. Defense and offense bill to the same subscription.
The assumption that you are too small to target is shaky: Three people got into a major lab. Maintainers and indie developers sit on the other side of the same risk: if one repository you reference is taken over, your users get hit.
The blast radius is an estimate: AIR puts the number of affected agents in the millions. No exploitation in the wild has been published, and there is no way to count how many developers installed the plugins.
A model that only returns decisions is drawing attention from developers: TypeSafe AI, founded by an OpenAI alumnus who worked on ChatGPT and RLHF, released Jev this week. Instead of prose it returns decisions with probabilities attached, output tokens are free, and input tokens bill by the billion rather than the million. Vercel said swapping its safety classifier from OpenAI’s Luna to Jev made it 5 to 18 times faster and more accurate. TechCrunch
Meta Muse reached the Mac: It works with files, messages, calendar, notes, and mail inside each app. Access is granted per item and sensitive actions need approval every time. TechCrunch
Anthropic’s first embedded evaluator is Accenture: Staff from Faculty, which Accenture acquired in January, will run model red-teaming, alignment evaluation, and safety testing inside Anthropic. The two companies are putting at least $1 billion into the work over five years, and Accenture shares rose 8% after hours on the news. TechCrunch
Google turned CC into a family assistant: CC gets its own Google account and permissions and coordinates with family members. Each person picks what to share from Gmail and Calendar, and messages from chosen senders can be shared automatically. TechCrunch
Manus is raising $500 million at a $4 billion valuation: It is back to operating independently after Meta’s $2 billion acquisition was blocked by Chinese authorities. IDG Capital, Boyu Capital, and CATL are in talks as new investors, and restructuring for a Hong Kong listing is under discussion. TechCrunch
Anthropic says Claude leads 26% of its own model R&D: Counting everything Claude contributes, about 90% of R&D work involves collaborating with it. The same announcement proposed publishing development-speed metrics across the industry. The Canberra Times
The FAA is standing up an $875 million AI traffic tool: SMART will predict air traffic flow and potential conflicts at three Washington DC airports. It could start as early as September 21, with plans to expand across the country. Ars Technica
A US government website used a Chinese model the FBI called malicious: The Federal Register briefly surfaced Alibaba Qwen search results before pulling them. Earlier this month the FBI named Alibaba as one of six Chinese companies doing industrial-scale distillation. Ars Technica
California is weighing a kill switch for frontier models: Governor Newsom signed an executive order and asked a panel of experts for recommendations within two months. The items under review include resident auditors with independent verification, outside validation of transparency reports, and major-incident reporting when control is lost. The Verge
Virginia is tightening data center approvals: Governor Spanberger signed Executive Order 22, barring nondisclosure agreements on data center projects, moving noise rules forward, and requiring review of backup generation. It also creates an AI task force on workforce displacement and data privacy. The Verge