MemTensor's Latest Tag Was the Implant. Clean Builds Lasted Minutes.
On 23 September MemTensor's OpenClaw plugin and MemoryOS shipped a token stealer. Clean builds lasted minutes. Pulling the versions did not end the impact clock.
Plugin4Shell Bypassed the Pin. Copilot Still Has No Patch.
Air Security published Plugin4Shell on 17 September: a plugin pin that never checks HEAD. Claude Code 2.1.179 and Codex 0.146.0 are patched. Copilot is not.
The short answer
Air Security published Plugin4Shell on 17 September. Claude Code, Codex, GitHub Copilot, and Gemini CLI checkout a marketplace plugin pin and never confirm the working tree matches it. Auto-update makes the swap zero-click. Anthropic patched Claude Code in 2.1.179. OpenAI patched Codex in 0.146.0. Microsoft has not shipped a Copilot fix. Google will not patch Gemini CLI.
Key takeaways
- Plugin4Shell is a SHA-pin bypass in four coding agents. The agent checks out the pinned commit and never confirms that HEAD is that commit.
- Zero-click comes from background plugin auto-update, the default in Claude Code and Codex. The victim already trusted the plugin. No new install prompt.
- A marketplace cannot close this. The pin is resolved on the client. Only an agent-side check after checkout restores the guarantee.
- Claude Code 2.1.179 and Codex 0.146.0 are patched. GitHub Copilot has no shipped fix. Gemini CLI is deprecated and will not be patched.
- Doing the review and pin is not enough on an unpatched agent. Treat pinned plugins on Copilot and Gemini CLI as untrusted until the client verifies HEAD.
US Google Trends on 17 September were still consumer noise. US X Trends were football and reality television. The operator post that landed tonight is Air Security's Plugin4Shell write-up: four coding agents resolve a marketplace plugin pin and never check that the working tree is that commit.
Hacker News spent the evening on CrowdSec's May leak and OpenAI's Astra-for-Law demo. This is the other host: the pin you already trusted.
High SHA-pin bypass, background auto-update, code as the developer. High because the pin was the control and it did not hold, not because every laptop is already owned.
The source page, 17 September. Not a diagram.
What Air Security actually published.#
On 17 September, Or Nevo, Dor Granat, and Niv Hoffman wrote that Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI share one design error. The agent checks out the commit the marketplace pinned. It does not confirm that the commit now in the working tree is that object.
The result they name is remote code execution on the host that runs the agent. Plugins inherit the developer's reach: source, tokens, production credentials. A malicious plugin does not need a second hop.
Zero-click is the auto-update path. Claude Code and Codex refresh installed plugins in the background by default. The victim already reviewed the plugin and already has it. When the pin changes upstream, the same checkout runs again. No prompt.
Air's own earlier work is the setup, not the hole. They have already shown a skill can go viral from a marketplace, and that maintainers' repositories can be taken over. Plugin4Shell is the layer that was supposed to survive those two: the pin.
We are not printing the checkout that proves it. The operator fact is enough: if the client never compares HEAD to the pin, the pin is a label.
Why two labs patched and two did not.#
Air disclosed to all four vendors in June.
Anthropic confirmed a fix in Claude Code 2.1.179 on 17 June. OpenAI's Codex 0.146.0, tagged in August, lists a change that verifies Git plugin SHA checkouts. Air says it verified that build on 12 August.
Microsoft has not shipped a Copilot fix. Google told Air on 4 August that Gemini CLI is deprecated and will not be patched. Air's migration note is Antigravity, which does not use marketplace SHA pinning.
- Air Security finds the pin bypass and reproduces it against all four agents.
- Coordinated disclosure to Anthropic, OpenAI, Microsoft, and Google.
- Anthropic confirms the fix in Claude Code 2.1.179.
- Google says Gemini CLI will not be patched. Users are told to migrate.
- Air verifies Codex 0.146.0. The release notes include a Git plugin SHA checkout check.
- Plugin4Shell goes public. Copilot still has no shipped client check.
What this is not.#
It is not a model jailbreak. The model is not the actor. The client that installs the plugin is.
It is not CrewAI's repository load 0-day. Different product, different load path, and that advisory still has no vendor patch URL. It is not GitSpawn. GitSpawn is a helper named from a cloned tree. This is a pin the marketplace already wrote.
It is also not proof that every marketplace plugin is hostile. Air needs the attacker to control the plugin repository. The failure is that the pin did not survive that control.
What to do.#
If your developers run a coding agent that installs marketplace plugins:
- Raise Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Those are the builds Air names. Confirm the version on the laptop, not in a wiki.
- On GitHub Copilot, disable marketplace plugin auto-update until Microsoft ships a client-side HEAD check. Stop adding plugins from git hosts you do not operate.
- Treat Gemini CLI as stay-vulnerable. Move those users. Air's stated destination is Antigravity. Do not wait for a Gemini CLI patch.
- Inventory plugins that auto-updated since June. A pin that refreshed on an unpatched client is a load, not a review. Delete anything nobody can name.
- If you ship an agent that installs from a pin, compare the resolved HEAD to the pin after checkout and abort on mismatch. A marketplace policy is not that check.
US X spent the night on Astra and a Minecraft creeper. The ticket you can close is a plugin pin that four agents resolved and two still do not verify. Raise the patched builds. Turn Copilot auto-update off. Then read the plugin list as if someone already refreshed it.
Frequently asked
Is there a CVE number?
Air Security published the finding as Plugin4Shell. We have not seen a MITRE or NVD record. File the ticket under that name and the patched build numbers. The operator fact does not wait on a CVE: checkout without a HEAD check, auto-update, two labs patched, two did not.
Does pinning to a reviewed commit protect us?
Not on an unpatched agent. The pin is what the marketplace wrote. The hole is that the client never confirms the working tree is that object. A reviewed commit can still be what the UI reports while different code lands. The check has to run after checkout, inside the agent.
Do we have to have installed something new?
No. Air's zero-click claim is the already-installed plugin plus background auto-update. Claude Code and Codex do that by default. The attacker needs control of the plugin repository, not a new click from the victim.
What should a security team change tonight?
Raise Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. On Copilot, turn off marketplace plugin auto-update and stop installing from git hosts that are not GitHub until Microsoft ships a client check. Move Gemini CLI users off that binary. Inventory plugins that auto-updated since June.
Sources
Related
OpenAI Mailed a Public Inbox. The Agent Had Already Written Files.
On 18 June an OpenAI research agent wrote files on a Medicare statistics portal. The 10 September notice went to a public mailbox. No patient record is known.
Read-Only Codex Still Ran the Repo Owner's Code.
Accomplish found two Codex sandbox escapes. Heapjack ran host commands from read-only. Overpatch wrote outside the workspace. OpenAI fixed both in eight days.