# Plugin4Shell Flaw Lets Attackers Hijack Claude Code, Codex, Copilot and Gemini CLI Without a Click

*2026-09-18 22:00 UTC · Technology · 1 min read*

> Air researchers found that pinned plugins in four AI coding agents can be swapped for malicious code; Anthropic and OpenAI have patched, Copilot has not.

Security startup Air disclosed "Plugin4Shell," a zero-click remote code execution flaw affecting four major AI coding agents: Anthropic's Claude Code, OpenAI's Codex, GitHub Copilot and Google's Gemini CLI. Plugin marketplaces lock each plugin to a reviewed commit hash, but the agents never verify that the checkout actually landed on that commit. A repository owner can create a branch named like the pinned hash and point it at different code, so the agent installs it while still reporting the locked version.

Because Claude Code and Codex auto-update installed plugins by default, a swapped pin needs no user action. Attackers could either publish a benign plugin that turns malicious later, or hijack an existing plugin repository. Air found the flaw in May 2026 and notified vendors in June.

Anthropic fixed the issue in Claude Code 2.1.179 and OpenAI in Codex 0.146.0. Google is retiring Gemini CLI and points users to its Antigravity environment, which is not affected, while GitHub Copilot still has no fix.

## Sources

- [helpnetsecurity.com](https://www.helpnetsecurity.com/2026/09/18/plugin4shell-ai-coding-agents-vulnerability/)
- [theregister.com](https://www.theregister.com/security/2026/09/17/ai-coding-agents-0-click-rce-flaw-could-hand-attackers-keys-to-the-kingdom/5297335)
- [thehackernews.com](https://thehackernews.com/2026/09/plugin4shell-lets-repository-owners.html)

---
TechTools News · https://techtools.cz/tools/news/article/2397-plugin4shell-flaw-lets-attackers-hijack-claude-code-codex-copilot-and-gemini
Česká verze: https://techtools.cz/tools/news/clanek/2470-chyba-plugin4shell-umoznuje-bez-kliknuti-ovladnout-claude-code-codex-copilot-i