# Plugin4Shell Bypassed the Pin. Copilot Still Has No Patch. > Air Security published Plugin4Shell on 17 September. Claude Code, Codex, GitHub Copilot, and Gemini CLI checkout a marketplace plugin pin and never confirm the working tree matches it. Auto-update makes the swap zero-click. Anthropic patched Claude Code in 2.1.179. OpenAI patched Codex in 0.146.0. Microsoft has not shipped a Copilot fix. Google will not patch Gemini CLI. Source: https://hackerlogs.com/blog/plugin4shell-sha-pin-rce Published: 2026-09-17 ## Key takeaways - Plugin4Shell is a SHA-pin bypass in four coding agents. The agent checks out the pinned commit and never confirms that HEAD is that commit. - Zero-click comes from background plugin auto-update, the default in Claude Code and Codex. The victim already trusted the plugin. No new install prompt. - A marketplace cannot close this. The pin is resolved on the client. Only an agent-side check after checkout restores the guarantee. - Claude Code 2.1.179 and Codex 0.146.0 are patched. GitHub Copilot has no shipped fix. Gemini CLI is deprecated and will not be patched. - Doing the review and pin is not enough on an unpatched agent. Treat pinned plugins on Copilot and Gemini CLI as untrusted until the client verifies HEAD. US Google Trends on 17 September were still consumer noise. US X Trends were football and reality television. The operator post that landed tonight is [Air Security's Plugin4Shell write-up](https://www.air.security/blog-posts/plugin4shell): four coding agents resolve a marketplace plugin pin and never check that the working tree is that commit. Hacker News spent the evening on CrowdSec's May leak and OpenAI's Astra-for-Law demo. This is the other host: the pin you already trusted. SHA-pin bypass, background auto-update, code as the developer. High because the pin was the control and it did not hold, not because every laptop is already owned. The source page, 17 September. Not a diagram. Air Security's 17 September Plugin4Shell post: the title, the lede naming Claude Code, Codex, Copilot, and Gemini, and authors Nevo, Granat, and Hoffman. ## What Air Security actually published. On 17 September, Or Nevo, Dor Granat, and Niv Hoffman wrote that Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI share one design error. The agent checks out the commit the marketplace pinned. It does not confirm that the commit now in the working tree is that object. The result they name is remote code execution on the host that runs the agent. Plugins inherit the developer's reach: source, tokens, production credentials. A malicious plugin does not need a second hop. Zero-click is the auto-update path. Claude Code and Codex refresh installed plugins in the background by default. The victim already reviewed the plugin and already has it. When the pin changes upstream, the same checkout runs again. No prompt. Air's own earlier work is the setup, not the hole. They have already shown a skill can go viral from a marketplace, and that maintainers' repositories can be taken over. Plugin4Shell is the layer that was supposed to survive those two: the pin. > The pin is resolved inside the agent. Air is explicit: a marketplace cannot fully close it. Restricting hosts that reject hash-shaped branch names blunts one variant and bans backends the agents document as supported. It does nothing for Gemini CLI's variant. The check has to run after checkout. We are not printing the checkout that proves it. The operator fact is enough: if the client never compares HEAD to the pin, the pin is a label. ## Why two labs patched and two did not. Air disclosed to all four vendors in June. Anthropic confirmed a fix in Claude Code 2.1.179 on 17 June. OpenAI's Codex 0.146.0, tagged in August, lists a change that verifies Git plugin SHA checkouts. Air says it verified that build on 12 August. Microsoft has not shipped a Copilot fix. Google told Air on 4 August that Gemini CLI is deprecated and will not be patched. Air's migration note is Antigravity, which does not use marketplace SHA pinning. > A reviewed pin on Copilot or Gemini CLI is not a control tonight. Turn auto-update off on Copilot. Stop installing plugins from git hosts you do not operate. Move Gemini CLI users. Then raise the two patched agents and inventory what already refreshed. ## What this is not. It is not a model jailbreak. The model is not the actor. The client that installs the plugin is. It is not [CrewAI's repository load 0-day](/blog/crewai-zdi-0day-rce). Different product, different load path, and that advisory still has no vendor patch URL. It is not [GitSpawn](/blog/gitspawn-ai-agents-git-hijack). GitSpawn is a helper named from a cloned tree. This is a pin the marketplace already wrote. It is also not proof that every marketplace plugin is hostile. Air needs the attacker to control the plugin repository. The failure is that the pin did not survive that control. ## What to do. If your developers run a coding agent that installs marketplace plugins: 1. Raise Claude Code to 2.1.179 or later and Codex to 0.146.0 or later. Those are the builds Air names. Confirm the version on the laptop, not in a wiki. 2. On GitHub Copilot, disable marketplace plugin auto-update until Microsoft ships a client-side HEAD check. Stop adding plugins from git hosts you do not operate. 3. Treat Gemini CLI as stay-vulnerable. Move those users. Air's stated destination is Antigravity. Do not wait for a Gemini CLI patch. 4. Inventory plugins that auto-updated since June. A pin that refreshed on an unpatched client is a load, not a review. Delete anything nobody can name. 5. If you ship an agent that installs from a pin, compare the resolved HEAD to the pin after checkout and abort on mismatch. A marketplace policy is not that check. US X spent the night on Astra and a Minecraft creeper. The ticket you can close is a plugin pin that four agents resolved and two still do not verify. Raise the patched builds. Turn Copilot auto-update off. Then read the plugin list as if someone already refreshed it. ## Sources - [Plugin4Shell - Zero Click RCE Vulnerability found in top 4 most popular coding agents, millions of agents affected](https://www.air.security/blog-posts/plugin4shell) (2026-09-17) - [Codex 0.146.0](https://github.com/openai/codex/releases/tag/rust-v0.146.0) (2026-08-12) - [Claude Code changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) (2026-06-17) - [Plugin4Shell: SHA-Pinning Bypass Across Major AI Coding Agents](https://x.com/air__security/status/2100683528383975636) (2026-09-17)