Plugin4Shell: SHA-pinning of code agents checked for the right commit number, but not the right code

A no-interaction remote code execution flaw affects the extension marketplaces of Claude Code, Codex, Gemini CLI, and Microsoft's two Copilots.

Air's security team — Or Nevo, Dor Granat and Niv Hoffman — has published a vulnerability called Plugin4Shell, which targets the extension mechanisms of the main coding agents. The principle of SHA-pinning consists of freezing a plugin on a specific commit identifier. The agents checked that the commit matched the one announced by the marketplace, but never that this commit always contained the expected code: an attacker could therefore substitute a malicious payload by keeping the pin intact, hence a remote code execution without the slightest click by the user.

Claude Code, Codex, Gemini CLI, Microsoft Copilot, and GitHub Copilot were affected. The researchers notified all four vendors in June 2026. Anthropic patched in Claude Code 2.1.179, OpenAI in Codex 0.146.0, Google deprecated Gemini CLI in favor of Antigravity CLI, and GitHub Copilot now rejects reference names resembling SHA fingerprints. Microsoft Copilot did not have a fix at the time of publication.