What happened
Security researchers at Air Security found a bug in how four major AI coding agents install plugins, add-ons that extend what the tool can do, from online marketplaces. To keep plugins trustworthy, a marketplace locks each one to a single, reviewed version by recording its exact Git commit hash, a process called SHA-pinning. The idea is simple: once a plugin passes review, the code that actually runs should never change without the marketplace re-reviewing it. The researchers found that Claude Code, Codex, GitHub Copilot, and Gemini CLI all check out the pinned commit but never confirm the checkout actually landed there. An attacker who controls the plugin's underlying code repository, either by publishing a plugin that passes review and later changing it, or by taking over an existing trusted plugin's repository, can make the installation resolve to different, malicious code while the marketplace still reports the reviewed, pinned version as installed. Claude Code, Codex, and GitHub Copilot share one version of the trick, based on how Git resolves branch names. Gemini CLI is exposed through a separate mechanism in its own install process, with the same result. What makes this zero-click is that Claude Code and Codex both refresh installed plugins in the background by default. A plugin a business installed and reviewed months ago can be swapped out the next time it auto-updates, with no prompt, no new install step, and nothing for anyone to notice. Air Security found the flaw in May 2026 and reported it privately to all four vendors in June, before publishing. As of this writing, Anthropic has patched Claude Code in version 2.1.179 and OpenAI has patched Codex in version 0.146.0. Microsoft has not shipped a fix for GitHub Copilot. A GitHub spokesperson told The Register that GitHub itself blocks the specific branch-naming trick, which covers plugins hosted directly on GitHub, but Air says Copilot also supports plugin marketplaces hosted on Bitbucket and self-hosted Git servers, which remain exposed. Google has deprecated the consumer version of Gemini CLI and told researchers it will not patch this issue at all, pointing affected users instead to its newer tool, Antigravity, which does not use the vulnerable plugin system.
Why it matters for business owners
AI coding agents are no longer a developer-only tool. A growing number of small and medium-size businesses now use them, directly or through a contractor or agency, to build internal software, automate a manual process, or maintain a tool that used to require a full development team. That shift is exactly why this matters beyond engineering departments. A plugin installed inside one of these agents runs with the same access as the person running the agent: the source code it can see, any API keys or credentials available on that machine, and any cloud accounts or internal systems that developer's session can reach. A supply-chain flaw like this one does not require tricking anyone into clicking a bad link or falling for a phishing email. It only requires that a plugin your business already trusts, installed the right way, reviewed the right way, and pinned the right way, sits somewhere an attacker can quietly redirect. Any business relying on one of these four tools, whether that reliance is a developer on staff, a freelancer, or an outside agency building something for you, has a direct stake in which version is running and where its plugins come from.
What owners should not misunderstand
This is not evidence that AI coding agents are unsafe to use in general, and it is not a reason to stop using plugin marketplaces. It is evidence that one specific verification step was missing across four different vendors' agents, and that a security control's name does not guarantee the property it promises. SHA-pinning sounds like an exact-version lock because that is what it is designed to be. Here, the step that would have actually enforced it was missing at the one place that could have caught the problem: inside the agent itself, not the marketplace. Two of the four vendors have already fixed this. For any business running Claude Code or Codex, updating closes the issue. That is a meaningfully different situation than the two vendors that have not fixed it. GitHub's position, that its own platform already blocks the reported attack, is accurate but narrower than it may sound. It covers one variant of the bug, for plugins hosted specifically on GitHub. It does not cover Copilot plugins sourced from Bitbucket or a self-hosted Git server, both of which the agents officially support, and it does not clearly address Gemini CLI's separate installation mechanism. And "deprecated" does not mean "gone": Gemini CLI is still being published and still in active use by many developers, so a business that assumes an older, replaced tool is no longer a live risk should verify that directly rather than assume it.
The operational lesson
A security feature's name describes what it is supposed to do, not proof that it does it. SHA-pinning is a real, well-understood safeguard against exactly this kind of attack, and it still failed here because the enforcement step at the client, the one place a marketplace cannot reach, was missing. A business evaluating any AI tool's stated security controls should treat the name of the control as a starting question, not a finished answer: what does this actually verify, and where does that verification happen. The second lesson is about defaults. Automatic background updates are convenient and, for most software, a reasonable safety net. Here, that same convenience is what turned a one-time, reviewed install decision into an ongoing trust relationship nobody was actively watching. A plugin approved once keeps updating itself indefinitely, without anyone re-approving each version that lands. The third lesson is that patch status is not one thing across a category of tools. A business running more than one of these agents, which is common when different team members or contractors have their own preferences, is not equally exposed everywhere at the same time. Each tool needs to be tracked on its own.
What a serious business should do next
Start with an inventory. Find out which AI coding agent, or agents, your team, contractors, or agency actually use, and whether those tools install plugins from a marketplace. Update immediately wherever a fix exists. Claude Code should be on version 2.1.179 or later. Codex should be on version 0.146.0 or later. If either is pinned to an older version for any reason, unpin it now. For GitHub Copilot, check where your plugins actually come from. Plugins hosted directly on GitHub carry lower exposure to this specific flaw, according to GitHub's own stated protections. Plugins sourced from Bitbucket or a self-hosted Git server remain exposed until Microsoft ships a fix; consider restricting plugin sources to GitHub in the meantime. For Gemini CLI, treat it as unsupported for this issue. Google has said directly that it will not patch it. Migrate to Antigravity where practical, or at minimum stop installing new plugins through Gemini CLI's marketplace until you have your own confirmation from Google. Ask whoever manages your AI coding tools, in-house or outside, two direct questions: which exact versions are we running today, and who is responsible for keeping them updated. Do not assume this is happening automatically just because the tools update themselves. Finally, turn this into a light recurring check rather than a one-time reaction. A brief monthly review of AI tool versions and plugin sources is enough for most small and medium-size businesses, and it is far cheaper than finding out after the fact that a trusted plugin was not what it appeared to be.
The Atlacis view
Atlacis helps owners see the difference between using an AI tool that has a named security feature and knowing whether that feature is actually doing what its name promises, a distinction most businesses without a technical team have no practical way to check on their own. Atlacis helps map where a business's coding, automation, and workflow tools actually reach, the source code, credentials, and connected systems behind them, and builds a plain, ongoing routine for keeping those tools patched and reviewed, instead of a plugin or tool getting installed once and never looked at again.
The short version
- On September 17, 2026, security firm Air Security disclosed a vulnerability called Plugin4Shell, affecting four major AI coding agents: Anthropic's Claude Code, OpenAI's Codex, Microsoft's GitHub Copilot, and Google's Gemini CLI, independently confirmed by The Register, Help Net Security, and InfoWorld.
- The bug breaks SHA-pinning, the control meant to lock an installed plugin to one exact, reviewed version. An attacker who controls a plugin's repository can make the agent install different, malicious code while the marketplace still reports the reviewed version as running.
- Because Claude Code and Codex auto-update installed plugins by default, the swap can reach a plugin a business has already trusted and used for months, with no click and no install prompt.
- Anthropic patched Claude Code in version 2.1.179 and OpenAI patched Codex in version 0.146.0. As of publication, Microsoft has not shipped a fix for GitHub Copilot beyond platform-level protections for GitHub-hosted plugins, and Google says it will not patch the deprecated Gemini CLI at all.
- A plugin runs with the same access as the person running the agent, including source code, credentials, and connected systems, which makes this relevant to any business using these tools to build or maintain software, not only developers.
- Inventory which coding agent and plugin sources your team or contractors actually use, update Claude Code and Codex now, restrict Copilot plugin sources to GitHub until Microsoft ships a fix, and treat Gemini CLI as unsupported for this issue.
Where ATLACIS can help
Sources
- Air Security: Plugin4Shell, Zero Click RCE Vulnerability Found in Top 4 AI Coding Agents (September 17, 2026)
- The Register: AI coding agents' 0-click RCE flaw could hand attackers keys to the kingdom (Jessica Lyons, September 17, 2026)
- Help Net Security: Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched (Sinisa Markovic, September 18, 2026)
- InfoWorld: A zero-click RCE flaw in AI coding agents could have exposed enterprise systems (Anirban Ghoshal, September 18, 2026)