Plugin4Shell: Plugin Pin Bypass in AI Coding Agents

What to do

1. Confirm versions: claude --version should report 2.1.179 or later and codex --version 0.146.0 or later; update with claude update or npm i -g @openai/codex@latest.
2. Inventory installed agent plugins and the git host behind each plugin and marketplace; flag anything on Bitbucket or a self-hosted server.
3. For Copilot, disable automatic plugin updates where you can and remove plugins sourced from hosts that allow SHA-shaped branch names.
4. Plan a migration off Gemini CLI; Google directs users to Antigravity instead of patching.
5. If you run an internal marketplace, host plugins only where 40-hex branch names are rejected, and make install tooling check that git rev-parse HEAD equals the pinned SHA.

How to check if you are affected or compromised

• In each plugin checkout, list branches named like a commit hash or FETCH_HEAD: git -C <plugin-dir> for-each-ref --format='%(refname)' | grep -E '/([0-9a-f]{40}|FETCH_HEAD)$'
• Compare git -C <plugin-dir> rev-parse HEAD with the SHA pinned in the marketplace manifest; any mismatch means the pin was bypassed.
• Review recently updated plugins for new hooks, MCP servers or scripts that were not in the reviewed commit.

What happened#

On September 17, 2026, Air Security published Plugin4Shell. The flaw breaks the SHA pinning that plugin marketplaces for AI coding agents use to lock a plugin to a reviewed commit. Claude Code, OpenAI Codex, GitHub Copilot and Gemini CLI all cloned the plugin repository and checked out the pinned commit. None of them confirmed that the checkout actually landed on that commit.

Two git behaviors make that gap exploitable by whoever controls the plugin repository:

• Claude Code, Codex, Copilot: the attacker creates a branch whose name is the 40-character pinned SHA and makes it the default branch. Git prefers a ref over a commit with the same name, so git checkout <sha> lands on the attacker's branch.
• Gemini CLI: it fetches the pinned commit and then runs git checkout FETCH_HEAD. A default branch named FETCH_HEAD wins, and the fetched commit is discarded.

Air calls it zero-click because background plugin auto-update, the default in Claude Code and Codex, re-runs the checkout whenever the marketplace bumps the pin. The pinned commit can stay benign for review while the name resolves to malicious code. Air built working exploits for all four agents. It reports no exploitation in the wild, and the CVE is not in CISA KEV.

Who is affected#

Anthropic's advisory, GHSA-pq7j-f95f-qfcv, covers the plugin install flow in Claude Code and Claude Desktop before 2.1.179. It was published on October 9, with CVE-2026-86063 following on October 13. The CVE record scores it CVSS 4.0 7.5, and the GitHub advisory 7.7. Anthropic says auto-updating installs already have the fix. Codex fixed it in 0.146.0, released July 29, whose changelog lists "Verify Git plugin SHA checkouts" (#34644). At disclosure, Microsoft had shipped no client fix for Copilot. Google has declined to patch Gemini CLI, which is deprecated in favor of Antigravity.

Do you really need to act?#

Only if you use third-party agent plugins, and the urgency depends on where they are hosted. The branch-name variant needs a host that accepts 40-hex branch names. Air notes that GitHub rejects them, while Bitbucket and self-hosted git servers allow them. Plugins hosted on GitHub are therefore out of reach of that variant. The Gemini CLI variant does not depend on the host, as the Cloud Security Alliance points out.

The realistic attacker publishes a useful plugin, gets it approved, and later swaps the code, or takes over a trusted plugin's repository. Air's earlier research is a warning about scale: a test plugin of theirs reached more than 26,000 agents before it was pulled.

What to do now#

1. Check claude --version (2.1.179 or later) and codex --version (0.146.0 or later). Update with claude update or npm i -g @openai/codex@latest.
2. List every installed plugin and marketplace and the git host behind each. Anything on Bitbucket or a self-hosted server needs a closer look.
3. For Copilot, disable automatic plugin updates where possible and remove plugins you cannot verify. That removes the zero-click element.
4. Move Gemini CLI users to a maintained tool.
5. If you run an internal marketplace, add the check Air suggests to your install tooling: test "$(git rev-parse HEAD)" = "<pinned-sha>" || exit 1.

How to tell if you were hit#

In each plugin's local git checkout, look for hash-named or FETCH_HEAD branches with git for-each-ref --format='%(refname)' | grep -E '/([0-9a-f]{40}|FETCH_HEAD)$'. Compare git rev-parse HEAD with the pin in the marketplace manifest. A mismatch means the pin was bypassed, so treat the plugin's code as untrusted and review what it ran. For Claude Code, the plugin loading reference puts marketplace clones under ~/.claude/plugins/marketplaces/ and installed copies under ~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/. Also look for hooks, MCP server entries or scripts in recently updated plugins that the reviewed commit did not contain.

Timeline#

• May 2026 — Air Security finds the flaw and builds proofs of concept for all four agents.
• Jun 17, 2026 — Anthropic confirms the fix in Claude Code 2.1.179.
• Jul 29, 2026 — Codex 0.146.0 ships with plugin SHA checkout verification.
• Aug 4, 2026 — Google says Gemini CLI will not be fixed.
• Sep 17, 2026 — Air publishes Plugin4Shell. Help Net Security reports it on Sep 18.
• Oct 9, 2026 — Anthropic publishes GHSA-pq7j-f95f-qfcv. CVE-2026-86063 is published on Oct 13.

Vulnerability records

• CVE-2026-86063 · Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Air Security — Plugin4Shell air.security
2. Anthropic — GHSA-pq7j-f95f-qfcv: Plugin Commit SHA Pin Bypass Allows Installation of Attacker-Controlled Code github.com
3. CVE record — CVE-2026-86063 cve.org
4. OpenAI — Codex rust-v0.146.0 release notes github.com
5. Anthropic — Claude Code plugin loading reference (Find plugins on disk) code.claude.com
6. Cloud Security Alliance — Plugin4Shell: SHA-Pinning Bypass Enables AI Coding Agent RCE labs.cloudsecurityalliance.org

Coverage and analysis

1. Help Net Security — Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched helpnetsecurity.com